Readabler CVE-2026-74015

The target must run the Readabler WordPress plugin at a version earlier than 2.0.18 with the plugin active and its vulnerable endpoint reachable over the network. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special client-side conditions are required - exploitation works against default installations. The practical limiting factors are simply that the site must have this specific plugin installed and unpatched, and that the WordPress instance/endpoint is internet-reachable; there is no privilege, platform, or non-default-configuration barrier indicated in the data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a high-severity, low-complexity, unauthenticated network attack with a confidentiality-focused impact and a scope change, which is consistent with SQL injection that can read data across the application boundary. However, the strong signals largely come from CVSS alone: there is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation is theoretically easy but not confirmed to be occurring. The main mitigating factor for real-world prioritization is the product's moderate deployment footprint rather than any technical barrier - unauthenticated SQLi in default configurations should be treated as an urgent patch regardless of the missing EPSS/KEV signals. Note the impact metrics are somewhat unusual (I:N with A:L), suggesting a read-oriented injection rather than full data modification; verify actual write capability with the vendor advisory.

An unauthenticated attacker sends a crafted HTTP request containing malicious SQL to a Readabler plugin endpoint on a target WordPress site running a version below 2.0.18. Because no authentication or user interaction is required, the attacker can automate scanning across many sites to extract sensitive database contents such as user records or password hashes. No public POC is identified at time of analysis, but the low attack complexity makes exploitation straightforward once the vulnerable endpoint is identified.