EUVD-2026-51792
GHSA-fg67-hgjg-74qh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible AJAX endpoint requires only subscriber authentication; read-only SQL injection yields no confirmed integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
AnalysisAI
SQL Injection in CubeWP Framework plugin for WordPress (all versions through 1.1.30) enables authenticated attackers holding only subscriber-level access to append arbitrary SQL to database queries via the cubewp_remove_relation() AJAX handler, exposing the full WordPress database to read-based attacks. The flaw is particularly egregious because the code actively undoes WordPress's built-in injection protection: wp_unslash() strips the magic-quotes escaping that WordPress applies to all POST data, then the unescaped relation_id is interpolated directly into a raw SQL query without wpdb->prepare(), with sanitize_text_field() providing no SQL protection whatsoever. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low subscriber-level authentication bar significantly elevates real-world risk on sites with open user registration.
Technical ContextAI
CubeWP Framework is a WordPress plugin providing a no-code engine for building custom post types, fields, and content relationships. The vulnerability resides in two related locations: admin-functions.php at line 2655 (the AJAX dispatch layer) and class-cubewp-relationships.php at lines 251 and 261 (the relationship deletion logic). WordPress's wp_magic_quotes() function automatically applies addslashes() to all $_POST superglobal data as a baseline SQL injection defense. The vulnerable code path explicitly calls wp_unslash() on the relation_id POST parameter, which reverses this escaping - intentionally destroying the only automatic SQL protection layer - before the value is concatenated directly into a raw SQL string executed via wpdb. The subsequently applied sanitize_text_field() sanitizes for HTML/XSS output contexts but has no effect on SQL metacharacters. The correct pattern, wpdb->prepare() with parameterized placeholders, is absent entirely. CWE-89 (Improper Neutralization of Special Elements in an SQL Command) describes this root cause class: unsanitized, attacker-controlled input flows through a code path that actively neutralizes the protection layer before reaching a SQL execution sink.
RemediationAI
An upstream fix has been committed to the CubeWP Framework plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3627740%40cubewp-framework&new=3627740%40cubewp-framework); however, a tagged patched release version above 1.1.30 is not independently confirmed from available data - administrators should monitor the WordPress.org plugin page for CubeWP Framework and upgrade as soon as a patched version is published. As an immediate compensating control, disabling WordPress open user registration (Settings > General > uncheck 'Anyone can register') raises the exploitation bar from any internet user to only pre-existing authenticated accounts, meaningfully reducing real-world risk without functional impact for most sites. A Web Application Firewall rule targeting wp-admin/admin-ajax.php POST requests with the action=cubewp_remove_relation parameter and SQL metacharacters in relation_id can reduce exposure, though WAF bypass via encoding or obfuscation remains possible. If the CubeWP relationships feature is not actively in use, deactivating the plugin entirely eliminates the attack surface. Consult the Wordfence advisory for patch availability updates.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today