WP w3all phpBB CVE-2026-73998

Exploitation requires the attacker to hold a valid WordPress subscriber-level account on the target site, which is the lowest default user role in WordPress. This means sites with open user registration are directly exposed to any internet user who can complete registration. Sites that restrict registration (invite-only, email-domain whitelist, or registration fully disabled) limit exploitation to already-trusted internal users. No specific plugin configuration or non-default feature flag is identified in the available data as a prerequisite beyond the plugin being installed and active. The CVSS vector (PR:L) confirms at least low-privilege authentication is required - unauthenticated exploitation is not indicated.

The CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) reflects a network-reachable, low-complexity flaw requiring only subscriber-level access - meaning any registered user on the WordPress site can attempt exploitation without further privilege escalation. The scope change elevates the score and real-world concern: a successful injection could leak data from both the WordPress and phpBB databases, including hashed passwords and private user data. No EPSS score was provided in the input, which limits quantitative exploitation-probability assessment. The absence of a KEV listing and no confirmed POC moderates urgency somewhat, but the PR:L threshold is notably low - even a small community site with open user registration presents meaningful exposure. No SSVC signals were provided; inferred SSVC disposition based on AV:N, low complexity, and scope change would likely land in the 'Out-of-Cycle Patch' or 'Immediate' tier for internet-facing sites with open registration.

An attacker registers a free subscriber account on the target WordPress site and then sends a crafted HTTP request to a vulnerable plugin endpoint, injecting SQL syntax into a user-controlled parameter. The injected query is executed against the shared database, returning rows from the WordPress or phpBB user tables - including email addresses and password hashes - in the HTTP response or via time-based blind inference. No public POC is confirmed at time of analysis, but the low complexity and wide availability of generic SQL injection tooling (e.g., sqlmap) means exploit development requires minimal specialized skill.