EUVD-2026-96751
GHSA-64x7-jjvh-w54w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Tcard WP ≤1.8.0
-
ExploitSend crafted unauthenticated AJAX request
-
ExecutionInject SQL via unsanitised parameter
-
ImpactExtract database contents (users, hashes, secrets)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must have the Tcard WP WordPress plugin version 1.8.0 or earlier installed and active, exposing the vulnerable unauthenticated AJAX endpoint (admin-ajax.php action) to the network. No authentication, credentials, user interaction, or special configuration is required (PR:N/UI:N), and default installations are exploitable. The practical limiting factor is purely deployment scope - exploitation requires that this specific, low-footprint plugin be present; there is no non-default feature toggle, platform constraint, or privilege prerequisite narrowing the attack surface. |
| Impact | Multiple signals align on genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the worst-case precondition profile for an internet-facing WordPress plugin, and the PR:N metric reliably establishes unauthenticated access. Public exploit code exists (WPScan), which raises practical exploitability above a theoretical-only flaw, but this is POC availability, not confirmed active exploitation: the CVE is NOT on CISA KEV, and no EPSS probability was supplied in the input, so widespread opportunistic exploitation cannot be asserted from the data. The CVSS impact is narrow - C:H with I:N and A:N - meaning data disclosure (database contents such as user records, hashes, secrets) rather than site modification or takedown, though SQL injection flaws of this class often enable follow-on integrity/authentication-bypass impact not captured by the base score. The S:C (scope change) in the supplied vector is debatable for a database-read SQLi and is the main driver pushing the score to 8.6; see the assessed vector rationale. Net: a real priority for anyone actually running this plugin on a reachable site because exploitation is trivial and public, but the small real-world footprint of this niche plugin limits aggregate exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's vulnerable AJAX action, injecting SQL through the unsanitised parameter to read arbitrary database contents such as WordPress user records and password hashes. Because public exploit code is available via WPScan and no authentication or user interaction is required, the attack can be automated against any reachable site running Tcard WP ≤ 1.8.0. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
RemediationAI
No vendor-released patched version was identified in the available data at time of analysis - 1.8.0 is the latest version referenced, and the WPScan advisory (https://wpscan.com/vulnerability/cedd2a79-a718-4398-8df4-786b3b585090/) should be checked directly for a fixed release before upgrading. The most reliable action is to deactivate and remove the Tcard WP plugin entirely if it is not business-critical, which eliminates the attack surface with no side effects beyond loss of the plugin's functionality. If the plugin must remain, apply virtual patching: deploy a WAF or reverse-proxy rule that blocks requests to wp-admin/admin-ajax.php carrying the vulnerable action parameter (legitimate front-end traffic that still needs that action must be allow-listed, otherwise the plugin's public features will break), and combine it with rate limiting and IP reputation filtering - accepting that WAF rules are bypassable via encoding tricks and require tuning. Restricting access to admin-ajax.php by IP is not practical for a public site since legitimate visitors use it, and disabling admin-ajax.php globally will break other plugins. Finally, review database and web-server logs for anomalous UNION/SELECT patterns against the vulnerable action, rotate any credentials or secrets that may have resided in the database, and monitor for unexpected outbound or administrative activity, since successful exploitation yields high-confidentiality read access without integrity or availability impact and may therefore leave little trace in application state.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection caused by missing input sanitisation and output escaping: a parameter supplied to one of the plugin's AJAX handlers is concatenated directly into a SQL statement rather than being bound through WordPress's $wpdb->prepare() parameterised-query interface or otherwise validated. Because the action is registered as an unauthenticated handler (the wp_ajax_nopriv_ pattern in WordPress), it is reachable by any network client through the standard wp-admin/admin-ajax.php endpoint that every WordPress installation exposes, so no session, cookie, or privileged role is needed. The CPE record (cpe:2.3:a:unknown:tcard_wp:*:*:*:*:*:*:*:*) reflects that no definitive vendor namespace is registered for the plugin and that the tool covers all versions; the EUVD entry pins the affected range as Tcard WP 0 through 1.8.0. The CVSS vector supplied with the record rates scope as Changed (S:C) with C:H/I:N/A:N, whereas the independent assessment normalises scope to Unchanged (S:U) while retaining the read-only impact profile (high confidentiality, no integrity or availability loss) - consistent with an injection that is exploitable for data exfiltration such as reading wp_users credentials or other sensitive tables, but for which no modification or denial-of-service primitive is demonstrated.
Know when Tcard Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi gives AV:N/AC:L/PR:N/UI:N and C:H; I assess S:U (DB accessed within the same WordPress security authority) rather than the supplied S:C, and I:N/A:N as only read disclosure is established.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Technical POC Analysis
Evidence caveat: the only source available is the WPScan/WPVDB entry.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity flaw in the Tcard WP WordPress plugin (all versions through 1.8.0) lets anyone on the internet read data directly out of the site's WordPress database without logging in first, and working exploit code is already circulating. Because the plugin is an unofficial, low-footprint component, exposure is limited to organizations that have it installed and active, but any affected site should be treated as a potential source of leaked user records, credentials hashes, and business content. Leadership should care because this is a confidentiality event that can trigger breach-notification and privacy obligations, and no vendor fix is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Tcard WP plugin (all versions through 1.8.0) on any site where it is not business-critical; if it must remain active, block or allowlist access to the plugin's AJAX action at the WAF/reverse proxy, apply virtual-patching rules for SQL-injection patterns, restrict the site to a trusted network where feasible, and enable detailed database and web-server logging with alerting to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB