What is the CVSS score of CVE-2026-82227?

CVE-2026-82227 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WPBulky are affected by CVE-2026-82227?

WPBulky WordPress plugin versions 1.2.2 and earlier allow Contributor-level users to inject SQL commands and extract password hashes, customer data, and other sensitive information directly from the…

How to fix or mitigate CVE-2026-82227?

Within 24 hours, identify all WordPress instances running WPBulky version 1.2.2 or earlier and disable or uninstall the plugin immediately. Within 7 days, audit database logs and access patterns for suspicious SQL queries or unauthorized data access, conduct forensic review to detect any prior exploitation, and force password resets for all administrative and Contributor accounts. Within 30 days, implement database-level access controls restricting the WordPress database user account to minimum required permissions, enable SQL query logging with alerting for injection pattern detection, deploy Web Application Firewall (WAF) rules to block SQL injection attempts, implement multi-factor authentication for administrative accounts, and establish a quarterly plugin security audit process.

WPBulky CVE-2026-82227

EUVD-2026-67726 HIGH

SQL Injection (CWE-89)

2026-08-28 Patchstack

GHSA-v9xv-m7wg-ch65

SQLi Wpbulky

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-accessible, low-complexity injection requiring Contributor role; S:C reflects cross-schema database read potential; I:N because no write capability is demonstrated.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 15:54 vuln.today

CVE Published

Aug 28, 2026 - 14:33 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in WPBulky <= 1.2.2 versions.

AnalysisAI

SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation strictly requires an authenticated WordPress session with at least Contributor-level role (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 8.5 is broadly consistent with the attack profile: network-accessible, low complexity, no user interaction, but gated behind Contributor-level authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update WPBulky to the latest available version via the WordPress plugin repository or by consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpbulky-wp-bulk-edit-post-types/vulnerability/wordpress-wpbulky-plugin-1-2-2-sql-injection-vulnerability?_s_id=cve - no patched version number is independently confirmed from available input data, so verify the changelog before updating. … Detailed patch versions, workarounds, and compensating controls in full report.