What is the CVSS score of CVE-2026-4935?

CVE-2026-4935 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4935?

Yes, a public proof-of-concept exploit is available for CVE-2026-4935. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-4935?

Yes, a patch is available for CVE-2026-4935. Update the affected software to the latest version immediately.

OttoKit WordPress Plugin CVE-2026-4935

EUVD-2026-28532 HIGH

SQL Injection (CWE-89)

2026-05-08 WPScan

GHSA-gpvp-9x48-h5wv

SQLi WordPress

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

May 08, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

May 08, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

May 08, 2026 - 15:22 NVD

6.5 (MEDIUM) 8.6 (HIGH)

Analysis Generated

May 08, 2026 - 14:22 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

May 08, 2026 - 08:01 EUVD

CVE Published

May 08, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 08, 2026 - 06:00 nvd

MEDIUM 6.5

DescriptionCVE.org

The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.

AnalysisAI

Unauthenticated attackers can exploit SQL injection in OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23 due to improper input sanitization in SQL statement construction. The vulnerability allows remote attackers to extract sensitive data and modify database contents without authentication, though integrity impact is limited. Publicly available exploit code exists, and a patch has been released by the vendor.

Technical ContextAI

OttoKit is a WordPress plugin that automates workflow and task management functions. The vulnerability stems from CWE-89 (SQL Injection), where user-supplied input is incorporated directly into SQL queries without proper escaping or parameterized prepared statements. WordPress plugins using the global WPDB object must properly utilize prepared statements with placeholders (e.g., $wpdb->prepare()) to prevent SQL injection. The plugin fails to sanitize input before constructing SQL statements, allowing attackers to inject arbitrary SQL syntax through HTTP parameters accessible via the plugin's REST API or web-facing functions.

RemediationAI

Vendors and plugin maintainers should update OttoKit to version 1.1.23 or later immediately. WordPress site administrators must update the plugin to the patched version via the WordPress admin dashboard (Plugins → Installed Plugins → OttoKit → Update, or manually via wp-cli: wp plugin update ottokit). As a workaround before patching, disable the affected plugin entirely if it is not mission-critical; this eliminates the attack surface entirely but halts any automation workflows the plugin provides. Additional defensive measures include: restricting REST API access to authenticated users only via web application firewall (WAF) rules or .htaccess rules blocking unauthenticated access to wp-json endpoints, though this may break legitimate integrations. Monitor database query logs for suspicious SQL patterns (UNION SELECT, OR 1=1, comment sequences) to detect active exploitation attempts. Database user privileges should follow the principle of least privilege - the WordPress database user should have SELECT, INSERT, UPDATE, DELETE on wp_* tables only, not CREATE or DROP, to limit the scope of SQL injection impact.