What is the CVSS score of CVE-2026-57772?

CVE-2026-57772 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of WP Inventory Manager are affected by CVE-2026-57772?

WP Inventory Manager WordPress plugin (versions 2.4.0 and earlier) contains a high-severity SQL injection vulnerability allowing low-privilege users to extract sensitive data including user…

How to fix or mitigate CVE-2026-57772?

Within 24 hours, identify all WordPress installations using WP Inventory Manager versions 2.4.0 or earlier and restrict plugin access to trusted administrators only. Within 7 days, implement database-level permissions limiting the plugin's query scope to essential operations, deploy Web Application Firewall rules targeting SQL injection patterns, and enable database activity monitoring to detect anomalous queries. Within 30 days, determine whether the plugin is business-critical; if not, deactivate it immediately; if required, maintain monitoring and prepare for rapid deployment of vendor patches when available.

WP Inventory Manager CVE-2026-57772

EUVD-2026-43392 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Wp Inventory Manager

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network SQLi with low-privilege auth (PR:L) and no UI; primarily data disclosure (C:H) with limited write potential (I:L); scope kept Unchanged as injection stays within the DB security authority.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:36 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.

AnalysisAI

Blind SQL injection in the WP Inventory Manager WordPress plugin (versions up to and including 2.4.0) lets an authenticated attacker with low privileges inject crafted SQL into database queries, enabling extraction of arbitrary database contents such as user credentials and secrets. Reported by Patchstack, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but high-impact.

Technical ContextAI

The affected component is WP Inventory Manager, a WordPress plugin used to build and display item/asset inventories on WordPress sites (CPE cpe:2.3:a:wp_inventory:wp_inventory_manager). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-controllable input is concatenated into a SQL statement executed against the WordPress MySQL/MariaDB backend without proper parameterization or escaping. Because the injection is 'blind', results are not returned directly in the response; the attacker infers data through boolean or time-based inference against the WordPress database, which typically shares the wp_ tables (users, options, secrets) with the rest of the site.

RemediationAI

No vendor-released patched version is identified in the provided data (the range ends at <= 2.4.0 with no fix version named), so treat any release later than 2.4.0 as the target and verify a fixed build via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-inventory-manager/vulnerability/wordpress-wp-inventory-manager-plugin-2-4-0-sql-injection-vulnerability?_s_id=cve) and the WordPress.org plugin page before upgrading. Until a confirmed fix is available, compensating controls include deactivating and removing the WP Inventory Manager plugin (removes the feature entirely), restricting which low-privilege roles can reach the vulnerable plugin endpoints, and deploying a WordPress WAF (such as Patchstack or Wordfence) with a virtual patch / SQLi ruleset in front of the affected parameters - noting that WAF rules can be bypassed and may block legitimate inventory queries. Tightening account provisioning so untrusted users cannot obtain the low-privilege role needed also reduces exposure at the cost of self-service registration.