WordPress Persistent Login CVE-2026-66594

Exploitation requires a valid WordPress subscriber account on a site running Persistent Login plugin version 3.1.0 or earlier. On sites where open user registration is enabled (a common but not universal WordPress configuration), an attacker can self-register at no cost, making the subscriber requirement a negligible barrier. On sites with registration disabled, exploitation is limited to individuals who already possess a legitimate subscriber, contributor, author, or higher-level account. No specific non-default plugin configuration is described as necessary - the vulnerability exists in standard plugin functionality. The attack is fully remote (AV:N) and requires no victim interaction (UI:N). Exploitation is limited to database read operations (C:H, I:N) based on the CVSS integrity metric.

The CVSS 8.5 score is driven by network accessibility (AV:N), low attack complexity (AC:L), subscriber-level authentication (PR:L), no required user interaction (UI:N), a scope change (S:C), and high confidentiality impact (C:H). The scope change is the most significant amplifier here - it indicates that the SQL injection reaches data stores beyond the plugin itself, effectively exposing the entire WordPress database. The subscriber authentication requirement (PR:L) is the primary limiting factor: a site with open user registration reduces this bar to near-zero, since any visitor can self-register a subscriber account, while sites with registration disabled meaningfully restrict the attack surface. No EPSS probability score, KEV listing, or POC code is present in the provided intelligence, so exploitation urgency beyond the CVSS signal cannot be independently confirmed. A practical read: organizations running this plugin on WordPress sites with open registration should treat this as urgent regardless of scale, because the credential-exposure potential (administrator password hashes, secret keys) enables full site compromise as a follow-on step. Sites with registration closed face lower but non-negligible risk from existing low-privilege accounts.

An attacker registers a free subscriber account on a target WordPress site with open registration enabled, then authenticates and submits a crafted request to the vulnerable plugin endpoint, injecting a UNION-based or boolean-blind SQL payload. The injected query traverses the WordPress database, extracting administrator password hashes, email addresses, or stored API keys. No public POC is currently identified, but the low attack complexity (AC:L) and absence of user interaction (UI:N) indicate a straightforward exploit path once the injectable parameter is located.