What is the CVSS score of CVE-2026-65546?

CVE-2026-65546 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Qode Tours are affected by CVE-2026-65546?

Qode Tours WordPress plugin versions through 3.1.3.1 contain an unauthenticated SQL injection vulnerability allowing remote attackers to extract user databases and credential hashes without barriers.

How to fix or mitigate CVE-2026-65546?

Within 24 hours, audit all WordPress installations for Qode Tours plugin versions 3.1.3.1 or earlier and immediately deactivate the plugin entirely; if operationally critical, deploy emergency WAF rules to block access to the vulnerable tour/booking endpoints as a temporary measure. Over the following 7 days, review database access logs and application logs for SQL injection exploitation patterns, conduct database integrity validation, and force password resets for all user accounts to invalidate any extracted credentials. Within 30 days, continuously monitor Patchstack and Qode Tours vendor advisories for patch availability; if no patch is released, schedule permanent deactivation and plan migration to an alternative WordPress tour/booking solution.

Qode Tours CVE-2026-65546

EUVD-2026-53976 CRITICAL

SQL Injection (CWE-89)

2026-08-06 Patchstack

GHSA-4vp4-w75c-2pjq

WordPress SQLi Wordpress Plugin Qode Tours

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Remote unauthenticated low-complexity SQLi yields C:H; injection point appears read-only (I:N/A:N), and I keep scope unchanged as the DB is the same security authority as the app.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:32 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

AnalysisAI

SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

The affected component is Qode Tours, a commercial WordPress plugin (CPE cpe:2.3:a:qode:qode_tours) used to build tour/travel booking and listing pages. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a SQL query without proper parameterization or sanitization, typical of WordPress plugins that build $wpdb queries from request parameters (e.g., filtering, search, or booking IDs) without using prepared statements. In shared WordPress hosting the plugin runs against the site's MySQL/MariaDB database, so injected SQL executes with the web application's database privileges.

RemediationAI

No vendor-released patch version is identified in the available data (the affected range is ≤3.1.3.1 with no confirmed fixed release), so update to the latest Qode Tours release above 3.1.3.1 as soon as the vendor publishes one and monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/qode-tours/vulnerability/wordpress-qode-tours-plugin-3-1-3-1-sql-injection-vulnerability for the fixed version. Until a patched build is confirmed, deploy a WAF or WordPress virtual patch (Patchstack offers one for this CVE) with SQLi rules covering the plugin's request parameters; if the plugin's tour listing/booking features are not essential, deactivate and remove the plugin, accepting loss of that functionality; alternatively restrict access to the affected endpoints and enforce least-privilege on the WordPress database user (no unnecessary read access to sensitive tables) to limit data exposure, noting this reduces but does not eliminate the injection risk.