What is the CVSS score of CVE-2026-5028?

CVE-2026-5028 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Eight Day Week Print Workflow CVE-2026-5028

EUVD-2026-29397 MEDIUM

SQL Injection (CWE-89)

2026-05-12 Wordfence

GHSA-295r-rfjg-h3fh

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:49 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.5

DescriptionCVE.org

The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL injection in the Eight Day Week Print Workflow WordPress plugin (versions up to 1.2.6) via the 'title' parameter in the pp-get-articles AJAX action allows authenticated attackers with Subscriber-level access to extract sensitive database information. The vulnerability stems from insufficient escaping and lack of prepared statement usage, enabling attackers to append arbitrary SQL queries to extract confidential data with high confidentiality impact.

Technical ContextAI

The Eight Day Week Print Workflow plugin (CPE: cpe:2.3:a:10up:eight_day_week_print_workflow) is a WordPress plugin for managing print publication workflows. The vulnerability exists in the pp-get-articles AJAX action handler, specifically in how the 'title' parameter is processed in database queries. The root cause is CWE-89 (SQL Injection), resulting from insufficient input escaping and failure to use parameterized queries or prepared statements. The time-based blind variant means the injection is detected through observable delays in response times rather than direct error messages, making exploitation more covert but still reliable for data extraction.

RemediationAI

Upgrade the Eight Day Week Print Workflow plugin to version 1.2.7 or later, which implements proper SQL escaping and prepared statement usage in the pp-get-articles AJAX handler. Users should immediately apply this patch to all WordPress installations running affected versions. If immediate upgrading is not feasible, disable the Eight Day Week Print Workflow plugin entirely until patching is possible, as workarounds cannot reliably block SQL injection at the application level without code modification. Site administrators should also audit database access logs for suspicious query patterns and reset passwords for any user accounts with Subscriber-level access or higher on potentially compromised installations. Review WordPress user roster and remove unnecessary Subscriber accounts to reduce the pool of potential attackers who could leverage this vulnerability.