Nikstore Core CVE-2026-73388

Exploitation requires only that a target WordPress site has the Nikstore Core plugin (version 1.5 or earlier) installed and active, with the vulnerable request endpoint reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed against a default install. The main limiting factor is prevalence rather than configuration - the site must actually be running this specific, relatively niche plugin - and the reported impact is confidentiality-focused (C:H, I:N, A:L), so data disclosure is the realistic outcome rather than data modification. No non-default setting or special deployment mode is documented as a prerequisite in the available data.

The signals are largely aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, which is the classic profile for opportunistic and automated exploitation, and the 9.3 score is driven up by the changed scope (S:C) plus high confidentiality impact. That said, the impact metrics are somewhat unusual - C:H but I:N and A:L - implying the reported injection primarily leaks data rather than modifying it, so mass defacement is less likely than data theft. EPSS is not provided, and the vulnerability is absent from CISA KEV with no public POC identified, so there is no evidence of active exploitation yet; the risk is credible-but-unproven rather than confirmed. Given how trivially SQLi is weaponized once a vector is public, even a mid-sized municipal IT team in koszalin should treat this as urgent if it runs the plugin on an internet-facing site. Net assessment: a real and actionable priority for anyone running Nikstore Core, tempered by the plugin's likely small deployment footprint.

An attacker discovers an internet-facing WordPress site running Nikstore Core <= 1.5 via plugin fingerprinting, then sends a single crafted HTTP request with a malicious SQL payload in a vulnerable parameter, requiring no authentication or user interaction. The injected query returns database contents such as usernames and password hashes from wp_users, enabling credential theft and follow-on account compromise. No public POC is currently identified, but SQLi of this class is routinely automated once details are published.