What is the CVSS score of CVE-2026-61966?

CVE-2026-61966 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of WPJAM Basic are affected by CVE-2026-61966?

WPJAM Basic WordPress plugin (versions 7.0.1 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to directly access and extract sensitive database contents…

How to fix or mitigate CVE-2026-61966?

Within 24 hours: disable or remove WPJAM Basic WordPress plugin from all production WordPress installations running version 7.0.1 or earlier; if the plugin provides critical functions, immediately restrict network access to the affected WordPress application using a Web Application Firewall (WAF) configured with SQL injection prevention rules. Within 7 days: audit database activity logs and review backup integrity to detect any unauthorized queries or data extraction since the vulnerability disclosure; document findings for incident response. Within 30 days: monitor Patchstack security advisories and the vendor's official channels for a patched version; upon release, test thoroughly in staging and deploy to all production systems; if no patch emerges within 30 days, plan and execute permanent removal or replacement of this plugin.

WPJAM Basic CVE-2026-61966

EUVD-2026-57971 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-4qrq-q3mh-x585

WordPress SQLi Wpjam Basic Wordpress Plugin Denishua

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network SQLi with low complexity; Patchstack's 'Subscriber' label implies a low-privilege account (PR:L), changed scope reaching the shared DB, high confidentiality with only low availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:47 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

AnalysisAI

SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject arbitrary SQL through an application entry point, exposing database contents. The Patchstack advisory classifies it as a 'Subscriber' SQL injection, implying low-privilege authenticated access, though the supplied CVSS vector marks it PR:N; either way the scope-changed impact (S:C) means the injected query reaches data beyond the plugin's own boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is WPJAM Basic (cpe:2.3:a:denishua:wpjam_basic), a general-purpose enhancement plugin for the WordPress CMS that runs inside the PHP/MySQL WordPress stack. The root cause is CWE-89: user-controllable input is concatenated into a SQL statement without proper parameterization or use of WordPress's $wpdb->prepare() sanitization, so crafted input alters query structure. Because WordPress plugins share the single site database, an injection here can read across tables (users, options, secrets) rather than being confined to plugin-specific data, which is consistent with the S:C (scope changed) rating.

RemediationAI

Upgrade WPJAM Basic to a release newer than 7.0.1; because the advisory bounds the flaw at '<= 7.0.1,' a patched build is expected but the exact fixed version is not stated in the available data, so confirm the current fixed version directly on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-0-1-sql-injection-vulnerability) or the plugin's WordPress.org page before deploying. If an updated version is not yet available, apply compensating controls: deploy a WordPress/WAF virtual patch (Patchstack, Wordfence, or ModSecurity CRS SQLi rules) in front of the vulnerable endpoint, which adds latency and can false-positive on legitimate queries; disable open user self-registration (Settings > General > Membership) to raise the bar if the flaw truly needs a Subscriber account, at the cost of blocking legitimate signups; and consider deactivating the WPJAM Basic plugin entirely until patched, accepting the loss of whatever site functionality it provides. Restrict database user privileges to the minimum needed to limit blast radius of any successful injection.