EUVD-2026-62389
GHSA-c3wv-g28g-q6ch
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (PR:N/AV:N/AC:L) with scope change to the DB (S:C); high confidentiality, limited integrity via injected writes, no meaningful availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
AnalysisAI
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a target WordPress site has the Nikstore Core plugin (version 1.5 or earlier) installed and active, with the vulnerable request endpoint reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed against a default install. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, which is the classic profile for opportunistic and automated exploitation, and the 9.3 score is driven up by the changed scope (S:C) plus high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-facing WordPress site running Nikstore Core <= 1.5 via plugin fingerprinting, then sends a single crafted HTTP request with a malicious SQL payload in a vulnerable parameter, requiring no authentication or user interaction. The injected query returns database contents such as usernames and password hashes from wp_users, enabling credential theft and follow-on account compromise. … |
| Remediation | No vendor-released patch version is identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/nikstore-core/vulnerability/wordpress-nikstore-core-plugin-1-5-sql-injection-vulnerability?_s_id=cve) is the authoritative reference and should be checked for a release beyond 1.5, which must be applied as the primary fix once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify those running Nikstore Core plugin version 1.5 or earlier and confirm internet exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today