What is the CVSS score of CVE-2026-59515?

CVE-2026-59515 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of AIWU Plugin are affected by CVE-2026-59515?

The ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) contains a critical blind SQL injection vulnerability (CVE-2026-59515, CVSS 9.3) that allows unauthenticated attackers…

How to fix or mitigate CVE-2026-59515?

Within 24 hours: disable and deactivate the ai-copilot-content-generator plugin across all WordPress installations and immediately reset all WordPress administrator credentials and database user passwords. Within 7 days: audit database access logs for suspicious queries targeting wp_users and sensitive tables, review all user account activity for unauthorized changes, and implement Web Application Firewall rules blocking SQL metacharacters in plugin input parameters. Within 30 days: conduct a full forensic audit of database contents accessed during the vulnerability window, notify affected users of any credential or data exposure, perform penetration testing to confirm remediation, and implement a replacement plugin with demonstrated security practices.

AIWU Plugin CVE-2026-59515

EUVD-2026-43429 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Aiwu

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network SQLi with low complexity; PR:L reflects the typical low-privilege auth for Patchstack plugin SQLi, scope unchanged, high confidentiality read but no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:23 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.

AnalysisAI

Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:sergey:aiwu:*) that adds AI-assisted content generation to WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into a SQL statement executed against the WordPress MySQL/MariaDB database without proper parameterization or escaping (e.g., missing use of $wpdb->prepare()). The "Blind" qualifier indicates the query results are not returned directly in the HTTP response, so an attacker infers data by observing behavioral or timing differences - a slower but fully effective extraction method. Patchstack, a WordPress-focused vulnerability intelligence vendor, is the reporting source.

RemediationAI

No vendor-released patch version is identified at time of analysis, so no exact upgrade target can be cited from the input; monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-4-sql-injection-vulnerability) and the WordPress.org plugin page for a release above 1.5.4 and apply it immediately when available. Until then, the safest compensating control is to deactivate and remove the ai-copilot-content-generator plugin, accepting loss of its AI content-generation feature. If removal is not acceptable, deploy a WordPress-aware WAF (such as Patchstack's own virtual patching) or restrict/authenticate access to the plugin's request endpoints via web-server rules, and consider blocking the affected AJAX/REST routes at the reverse proxy - noting this may break legitimate plugin functionality. As defense in depth, apply least-privilege to the database account used by WordPress to limit what a successful injection can read.