What is the CVSS score of CVE-2026-57756?

CVE-2026-57756 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of nicen-localize-image are affected by CVE-2026-57756?

The WordPress plugin nicen-localize-image (versions 1.4.9 and earlier) contains an authenticated SQL injection vulnerability enabling contributors to extract sensitive database records, including…

How to fix or mitigate CVE-2026-57756?

Within 24 hours: Audit all WordPress installations for nicen-localize-image usage and contributor role assignments. Within 7 days: Restrict contributor role access through capability filtering or disable the plugin if not critical; enable database query logging on wp_users and wp_options tables. Within 30 days: Monitor vendor advisory channels for patch release; evaluate alternative plugins or decommission if no patch becomes available.

nicen-localize-image CVE-2026-57756

EUVD-2026-41312 HIGH

SQL Injection (CWE-89)

2026-07-02 Patchstack

GHSA-vf3q-vv2j-4h2g

WordPress SQLi Wordpress Plugin Nicen Localize Image

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Contributor account required (PR:L) over the network with low complexity; SQLi reads data across DB scope (S:C, C:H) with minor availability effect and no integrity change.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:23 vuln.today

DescriptionCVE.org

Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

AnalysisAI

Authenticated SQL injection in the WordPress plugin nicen-localize-image (versions 1.4.9 and earlier) allows users holding the low-privilege Contributor role to inject arbitrary SQL into the WordPress database backend. Because the CVSS scope is changed and confidentiality impact is High, a Contributor can read data beyond the plugin's own remit, potentially extracting other users' credentials or secrets from the wp_users/wp_options tables. Reported by Patchstack with a CVSS of 8.5; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The affected component is nicen-localize-image, a WordPress plugin (vendor '友人a丶') whose function is to localize/download remote images into the local media library. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a database query without proper parameterization or use of WordPress's $wpdb->prepare() sanitization. WordPress plugins commonly introduce this class of flaw when building dynamic queries from request parameters (e.g., image IDs, search or filter arguments) via raw string concatenation. The CPE cpe:2.3:a:友人a丶:nicen-localize-image:*:*:*:*:*:*:*:* confirms all versions are in scope up to the fixed release, with the known vulnerable ceiling at 1.4.9.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/nicen-localize-image/vulnerability/wordpress-nicen-localize-image-plugin-1-4-9-sql-injection-vulnerability) for the fixed release and upgrade to any version above 1.4.9 as soon as it is confirmed available. Until a confirmed patch is applied, the most effective compensating control is to remove or downgrade untrusted Contributor accounts and disable open user self-registration (Settings > General > Membership), which directly eliminates the PR:L prerequisite at the cost of blocking legitimate new contributor sign-ups. Alternatively, deploy a WAF (such as Patchstack's virtual patch) with SQL injection rules targeting the plugin's endpoints, and audit the wp_users table for unauthorized privilege escalation; if the plugin is not essential, deactivating and removing it fully removes the exposure at the cost of losing image-localization functionality.