Throws SPAM Away CVE-2026-81763

Exploitation requires only that a WordPress site have Throws SPAM Away version 3.8.2 or earlier installed and active, with the vulnerable request-handling endpoint reachable over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is needed. The main limiting factor is deployment footprint - the target must actually run this specific, relatively niche plugin - rather than any privilege or configuration prerequisite. The exact vulnerable parameter/endpoint is not detailed in the provided data and should be confirmed via the Patchstack advisory.

The signals mostly align toward high severity: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, unauthenticated network exploitation and the CWE-89 class is well understood and often automatable. Confidentiality is rated High while integrity is None and availability Low, which suggests a primarily data-read exposure rather than full DB takeover. Tempering this, no EPSS score, no POC, and no KEV entry were provided, so there is no evidence of active or at-scale exploitation yet - the risk is currently 'high potential, unproven exploitation.' One point to verify: the vector sets S:C and I:N/A:L, an unusual combination for SQLi; the scope change is plausible for WordPress but the impact split should be confirmed against the Patchstack advisory.

An attacker sends a crafted HTTP request to a WordPress site running the plugin, embedding malicious SQL in an unauthenticated parameter processed by the vulnerable query. The injection returns or infers database contents such as administrator password hashes and secret keys, enabling follow-on account compromise. No public POC is identified, but the low complexity and lack of authentication make weaponization straightforward.