Leyka CVE-2026-42717

Exploitation requires an authenticated WordPress user with administrator-level capabilities on a site running the Leyka donation plugin at version 3.32.3 or earlier (PR:H). There is no user-interaction requirement (UI:N) and the attack is performed over the network against the admin interface. The dominant limiting factor is the administrator privilege prerequisite: this is not exploitable by anonymous or low-privileged users, which confines realistic risk to insider threats, compromised admin credentials, or sites that delegate administrator roles to semi-trusted parties. No non-default configuration is indicated as necessary in the available data.

This is a high-severity but operationally limited vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) indicates network-reachable, low-complexity exploitation, but PR:H means the attacker must already hold administrator-level privileges in WordPress - which the vulnerability title 'Administrator SQL Injection' corroborates. That dependency sharply reduces real-world risk: an attacker who already has WordPress admin rights has substantial control, so the incremental gain is primarily direct database read access (C:H) beyond the normal admin UI. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is: no public exploit identified at time of analysis. The scope-change flag (S:C) in the vendor vector is debatable for an authenticated admin SQLi and appears to inflate the base score; absent a cross-application impact described anywhere in the source data, S:U would be more defensible. Net assessment: a genuine but lower-priority issue for most deployments - patch during normal maintenance rather than emergency windows, prioritizing multi-author or delegated-admin sites where a lower-trust 'administrator' could abuse it.

An authenticated WordPress administrator (or an attacker who has already compromised an admin account, e.g., via phishing or credential reuse) submits crafted input to a vulnerable Leyka plugin parameter, injecting SQL that is executed against the WordPress database. This lets them read arbitrary database contents such as user records and password hashes beyond what the plugin UI normally exposes. No public proof-of-concept is identified in the provided data.