What is the CVSS score of CVE-2026-54811?

CVE-2026-54811 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP eMember are affected by CVE-2026-54811?

WP eMember WordPress plugin versions prior to 10.9.4 contain an unauthenticated SQL injection vulnerability (CVSS 9.3) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-54811?

24 hours: Inventory all WordPress instances running WP eMember plugin and document current versions; disable or restrict external access to affected instances where possible. 7 days: Update WP eMember to version 10.9.4 or later if available; if unavailable, implement interim mitigations (WAF rules, access controls, disable plugin if non-critical). 30 days: Complete remediation; audit database for unauthorized modifications; review access logs for exploitation attempts.

WP eMember CVE-2026-54811

EUVD-2026-37644 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wp Emember Wordpress Plugin Tips And Tricks Hq

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Network-reachable unauthenticated SQLi in a WordPress plugin shares the DB with core, justifying S:C and C:H; SQLi typically permits some write (I:L) but rarely DoS, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:50 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

AnalysisAI

Unauthenticated SQL injection in the WP eMember WordPress plugin versions prior to 10.9.4 allows remote attackers to inject arbitrary SQL through unsanitized input handled by the plugin. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 9.3 with a scope change, indicating impact beyond the vulnerable component; no public exploit identified at time of analysis.

Technical ContextAI

WP eMember is a membership-management plugin for WordPress published by Tips and Tricks HQ (CPE cpe:2.3:a:tips_and_tricks_hq:wp_emember). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into a SQL query executed against the WordPress database (typically MySQL/MariaDB) without proper parameterization or escaping. Because WordPress plugins share the site database, a SQLi in a single plugin can read or manipulate data belonging to WordPress core tables (users, options, sessions) as well as other plugins, which explains the CVSS scope change (S:C).

RemediationAI

Vendor-released patch: WP eMember 10.9.4 - site administrators should upgrade the plugin to 10.9.4 or later via the WordPress plugin updater immediately, referencing the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-emember/vulnerability/wordpress-wp-emember-plugin-v10-9-4-sql-injection-vulnerability for confirmation. If immediate patching is not possible, deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with virtual-patch rules for this CVE; restrict access to WP eMember frontend and admin endpoints via IP allowlisting at the web server or CDN, accepting that this will break legitimate member self-service; and temporarily deactivate the plugin if the membership functionality can be paused, noting this will disable paid member access for the duration. Rotate all WordPress admin credentials and any API keys stored in wp_options after upgrading, since data exfiltration prior to patching cannot be ruled out.