EUVD-2026-60819
GHSA-fv7m-82qw-8434
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); primary impact is data disclosure (C:H) with limited write potential (I:L), and I assess no scope change absent evidence the DB crosses a security authority (S:U).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
AnalysisAI
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must run the Readabler WordPress plugin at a version earlier than 2.0.18 with the plugin active and its vulnerable endpoint reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a high-severity, low-complexity, unauthenticated network attack with a confidentiality-focused impact and a scope change, which is consistent with SQL injection that can read data across the application boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request containing malicious SQL to a Readabler plugin endpoint on a target WordPress site running a version below 2.0.18. Because no authentication or user interaction is required, the attacker can automate scanning across many sites to extract sensitive database contents such as user records or password hashes. … |
| Remediation | Vendor-released patch: update the Readabler plugin to version 2.0.18 or later, which is the primary and definitive fix; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/readabler/vulnerability/wordpress-readabler-plugin-2-0-18-sql-injection-vulnerability) for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations for Readabler versions prior to 2.0.18 and immediately disable the plugin or restrict database access to it if disabling would impact accessibility requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today