What is the CVSS score of CVE-2026-57752?

CVE-2026-57752 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of iNET Webkit are affected by CVE-2026-57752?

The iNET Webkit WordPress plugin version 1.2.4 and prior contains a data breach vulnerability that allows any user account with Contributor-level permissions to extract the entire WordPress database,…

How to fix or mitigate CVE-2026-57752?

Within 24 hours: conduct inventory of all WordPress installations using iNET Webkit plugin and document current versions; audit which user accounts hold Contributor or higher roles. Within 7 days: disable the iNET Webkit plugin across all WordPress instances, as no vendor patch is available; restrict Contributor-level role assignments to named administrators only. Within 30 days: evaluate alternative plugin solutions; implement database access logging and monitoring to detect any historical or ongoing exploitation attempts.

iNET Webkit CVE-2026-57752

EUVD-2026-41308 HIGH

SQL Injection (CWE-89)

2026-07-02 Patchstack

GHSA-cjmw-28wm-95mp

WordPress SQLi Apple Inet Wordpress Plugin Inet Webkit

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-reachable SQLi needing a Contributor account (PR:L) at low complexity; primarily discloses database data (C:H) with limited integrity impact via injection (I:L) and no clear availability effect; scope kept unchanged as impact stays within the DB-backed application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:24 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in iNET Webkit 1.2.4 versions.

AnalysisAI

SQL injection in the iNET Webkit WordPress plugin (version 1.2.4 and prior) lets authenticated users holding at least the Contributor role inject arbitrary SQL through unsanitized input, exposing the WordPress database. Reported by Patchstack and carrying a CVSS 8.5 (scope-changed) rating, it enables read access to sensitive data such as user credentials and secrets. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is iNET Webkit, a WordPress plugin (CPE cpe:2.3:a:inet:inet_webkit) running in the PHP/WordPress stack against a MySQL/MariaDB backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable parameters reachable by low-privilege Contributor accounts are concatenated into SQL queries without parameterization or proper escaping, so crafted input alters query structure. In WordPress, Contributor is a low-trust role able to create draft posts but not publish, which makes any SQLi reachable at that privilege level notable.

RemediationAI

No vendor-released patch identified at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/inet-webkit/vulnerability/wordpress-inet-webkit-plugin-1-2-4-sql-injection-vulnerability) for an updated fixed version and upgrade as soon as one is published. Until then, restrict who can obtain Contributor accounts by disabling open user registration (Settings > General, uncheck 'Anyone can register') and audit existing low-privilege accounts, which shrinks the pool of attackers with the required role; deploy a WordPress-aware WAF or virtual patch (e.g. Patchstack) to block SQLi payloads against the plugin's endpoints, accepting possible false positives on legitimate content; and if the plugin is non-essential, deactivate and remove it to eliminate the attack surface at the cost of its functionality.