Post Title Marquee Scroll CVE-2026-42713

Exploitation requires an authenticated WordPress user holding HIGH privileges (PR:H in the CVSS vector), effectively administrator-level access, to reach the vulnerable plugin functionality - it is NOT remotely exploitable by anonymous users. The 'Post title marquee scroll' plugin by Gopiplus (versions up to and including 9.9) must be installed and active on the target WordPress site. The limiting factor is the admin-level authentication prerequisite, which sharply restricts the realistic attacker population; no special non-default configuration or user interaction is required once that privilege is held. Being a blind injection, exploitation also requires iterative inference (boolean/time-based) rather than direct data return.

This is a blind SQL injection (CWE-89) in the Gopiplus 'Post title marquee scroll' WordPress plugin, reported by Patchstack and rated CVSS 7.6. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L indicates a network-reachable, low-complexity attack with no user interaction, but critically requires HIGH privileges (PR:H) - meaning the attacker must already be an authenticated administrator-level user before exploitation. No EPSS score is provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' The real-world risk is materially lower than the 7.6 headline suggests: the PR:H requirement means an attacker already holding admin access is largely the only viable actor, and such an attacker can typically already read the database through legitimate means, which undercuts the blind-SQLi value. The S:C (scope changed) and A:L (low availability impact) choices in the input vector are debatable for a contained plugin SQL injection and should be treated with caution - see assessed vector below. Net: a genuine vulnerability worth patching, but a low-urgency, low-exploitation-probability issue rather than an emergency, given the obscure plugin and the admin-level precondition.

An authenticated administrator (or an attacker who has already compromised an admin account via phishing or credential reuse) submits crafted input to the vulnerable plugin parameter, injecting boolean- or time-based blind SQL payloads. By observing differential responses or response timing, the attacker iteratively extracts database contents such as user records and password hashes. No public exploit code is currently known for this specific CVE.