UDesign Core CVE-2026-42416

Requires an authenticated WordPress account at Subscriber level or higher on a site running the UDesign Core plugin version 4.15.0 or earlier (PR:L in the vector); this is the key limiting factor, meaning exploitation depends on either open user self-registration being enabled or the attacker already holding low-privilege credentials. No user interaction is required (UI:N) and the attack is fully remote over the network (AV:N) with low complexity (AC:L) once an account is held. The exact vulnerable endpoint/parameter is not disclosed in the provided data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication (PR:L), which maps directly to the 'Subscriber' role named in the description - self-registration is enabled on many WordPress sites, so the authentication barrier is low in practice. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the raw 8.5 severity toward a patch-on-normal-cadence priority rather than an emergency. The scope-change flag (S:C) combined with C:H and only A:L suggests the vendor/Patchstack judged the injection capable of reading data beyond the plugin's own security authority (e.g., the full WordPress database); however, I:N indicates no integrity/write impact was assessed, which is somewhat unusual for SQLi and is worth verifying against the Patchstack advisory. Overall this is a genuine high-severity data-confidentiality issue gated by a low (but non-zero) authentication requirement, best treated as a prompt-patch item absent exploitation signals.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running UDesign Core <= 4.15.0, then sends a crafted request to the vulnerable plugin endpoint containing malicious SQL in a parameter that is concatenated into a database query. The injection lets them read sensitive database contents such as user records and password hashes. No public exploit code was identified in the provided data, but SQL injection in authenticated WordPress plugins is typically straightforward to weaponize.