MLS On The Fly CVE-2026-61996

Exploitation requires an authenticated WordPress account at subscriber level or higher (PR:L) on a site running the MLS On The Fly plugin version 1.8.1.5 or earlier; no user interaction is needed (UI:N) and the attack is remote over the network (AV:N). The principal limiting factor is the authentication requirement - an attacker must be able to register or already hold a subscriber account, which is low-barrier on sites that permit open user registration but blocks fully anonymous attackers on sites that do not. The specific vulnerable parameter, endpoint, or feature that must be reachable is not described in the available sources. No special non-default configuration is indicated beyond having the affected plugin version installed and active.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-reachable, low-complexity SQL injection requiring only low privileges (PR:L) and no user interaction, with a changed scope and high confidentiality impact plus low availability impact. The 'Subscriber' qualifier in the description aligns with PR:L: an attacker needs an authenticated subscriber-level account, the lowest WordPress role, which on sites with open registration is trivial to obtain. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no evidence of active exploitation or weaponization. The single source is a Patchstack advisory, and the vuln.today decision label is 'this_week' rather than act_now/emergency. Net assessment: a genuinely serious vulnerability class (authenticated SQLi reading database contents) in a low-footprint product, warranting prompt patching within the week per the decision label, but not an emergency - the low privilege barrier is partly offset by requiring an account, and there is no confirmed in-the-wild exploitation. Note the signals are not conflicting; they are simply sparse (no EPSS/KEV/POC data provided).

An attacker registers or obtains a subscriber-level account on a WordPress site running MLS On The Fly <= 1.8.1.5, then sends a crafted request to a vulnerable plugin endpoint containing malicious SQL. Because scope is changed and confidentiality impact is high, the injection lets the attacker read sensitive database contents such as user records and password hashes beyond the plugin's own data. No public exploit code is identified in the provided data, and the exact vulnerable parameter is not described in the available sources.