What is the CVSS score of CVE-2026-56062?

CVE-2026-56062 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Quotes llama are affected by CVE-2026-56062?

The Quotes llama WordPress plugin (versions 3.1.5 and earlier) contains a critical SQL injection vulnerability enabling unauthenticated remote attackers to directly access and manipulate your…

How to fix or mitigate CVE-2026-56062?

Within 24 hours: Audit all WordPress installations for Quotes llama plugin versions 3.1.5 and earlier; document affected systems and database criticality. Within 7 days: Remove or disable the Quotes llama plugin from all affected WordPress instances; deploy Web Application Firewall rules blocking SQL injection patterns targeting vulnerable plugin endpoints. Within 30 days: Procure and deploy an alternative WordPress quoting solution; update plugin governance policies to include security scanning requirements.

Quotes llama CVE-2026-56062

EUVD-2026-39716 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-w84j-9mxx-58w2

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi with low complexity gives AV:N/AC:L/PR:N/UI:N; database access yields C:H and plausible limited write (I:L), with scope change to the shared DB.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:58 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

AnalysisAI

Unauthenticated SQL injection in the Quotes llama WordPress plugin (versions 3.1.5 and earlier) lets remote attackers without credentials inject malicious SQL through plugin input handling, exposing the WordPress database. The CVSS 3.1 base score of 9.3 reflects network reachability with no authentication and a scope change, meaning impact can reach beyond the plugin into the underlying database. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is Quotes llama, a third-party WordPress plugin (per the Patchstack reference), running inside the PHP-based WordPress application stack against a MySQL/MariaDB backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating user-controllable input is concatenated into a database query without parameterization or proper escaping - typically via WordPress's $wpdb interface used without prepared statements. Because WordPress plugins share the site's single database, an SQL injection in any plugin endpoint can reach core wp_users, wp_options, and other tables.

RemediationAI

No vendor-released patch version was identified in the available data, so a specific fixed release cannot be cited - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quotes-llama/vulnerability/wordpress-quotes-llama-plugin-3-1-5-sql-injection-vulnerability) for the latest fix status and upgrade to any release newer than 3.1.5 once published. As immediate compensating controls, deactivate and remove the Quotes llama plugin until a fixed version is confirmed (trade-off: any quote-display functionality it provides will be lost), or place a Web Application Firewall rule (such as Patchstack's or Wordfence's virtual patch) in front of the site to block SQL-injection patterns against the plugin's endpoints (trade-off: WAF rules can be bypassed and are a stopgap, not a fix). Additionally restrict the database account used by WordPress to least privilege and ensure database backups are current so exposure can be assessed.