What is the CVSS score of CVE-2026-39479?

CVE-2026-39479 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ottokit are affected by CVE-2026-39479?

CVE-2026-39479 is a blind SQL injection vulnerability in the WordPress plugin Brainstorm Force OttoKit (suretriggers) affecting versions through 1.1.20 that enables high-privilege administrators to…

How to fix or mitigate CVE-2026-39479?

Within 24 hours: Identify all WordPress instances running suretriggers plugin versions up to 1.1.20 using vulnerability scanning tools or manual plugin inventory audit. Within 7 days: Disable or remove the suretriggers plugin if not actively used; if required, restrict administrative role assignments to trusted personnel only and implement database query logging/WAF rules to detect SQL injection patterns. Within 30 days: Evaluate alternative WordPress plugins for core functionality and monitor Brainstorm Force advisories for a patched version update.

Ottokit CVE-2026-39479

EUVD-2026-20146 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-cvhv-59pg-p7r4

SQLi Ottokit

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:26 vuln.today

CVSS changed

Apr 13, 2026 - 17:22 NVD

7.6 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20146

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.

AnalysisAI

Blind SQL injection in Brainstorm Force OttoKit (WordPress plugin suretriggers) versions up to 1.1.20 allows privileged attackers with high-level administrative access to extract sensitive database information and potentially cause service disruptions. CVSS 7.6 severity driven by changed scope (container escape to underlying WordPress database). EPSS score of 0.02% (6th percentile) indicates very low observed exploitation probability. No public exploit identified at time of analysis, and no CISA KEV listing confirms active exploitation.

Technical ContextAI

OttoKit is a WordPress plugin (suretriggers) by Brainstorm Force that automates workflows and integrations. The vulnerability stems from CWE-89 (SQL Injection) where user-controlled input is not properly sanitized or parameterized before inclusion in SQL queries. Blind SQL injection specifically means attackers cannot see query results directly but can infer data through timing delays, boolean conditions, or error-based responses. The affected CPE (cpe:2.3:a:brainstorm_force:ottokit) confirms this impacts the OttoKit product line through version 1.1.20. WordPress plugins interact with the MySQL/MariaDB database backend, and insufficient input validation in database queries allows injection of malicious SQL commands that can read, modify, or disrupt database operations beyond the plugin's intended scope.

RemediationAI

Upgrade OttoKit (suretriggers) plugin to version 1.1.21 or later immediately, as this release addresses the SQL injection vulnerability according to Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability. Access WordPress admin dashboard, navigate to Plugins section, and apply available updates. If immediate patching is not feasible, implement compensating controls: restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, enforce multi-factor authentication for all administrator accounts, audit and remove unnecessary admin-level user accounts, and enable WordPress database query logging to detect anomalous SQL activity. Review admin access logs for suspicious authentication patterns that might indicate compromised credentials. No vendor-provided workaround exists that allows continued use of vulnerable versions safely.