EUVD-2026-74714
GHSA-wvp9-9jq4-8qh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request
-
DeliverySupply SQL metacharacters in vulnerable parameter
-
ExploitPlugin executes unprepared SQL query with injected payload
-
ExecutionDatabase returns arbitrary rows to attacker
-
ImpactExfiltrate credentials and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against any WordPress installation with the Quentn WP plugin active in versions prior to 1.2.15. The vulnerable parameter is reachable without authentication (PR:N per CVSS). The only limiting factor is that the Quentn WP plugin must be installed and active on the target site; sites not using this plugin are unaffected. No specific WordPress configuration, user role, or non-default setting is required to reach the vulnerable code path. |
| Impact | The CVSS base score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N accurately captures the severity: network-reachable, no prerequisites, read-all-database impact. Despite the high CVSS score, the EPSS score of 0.18% (7th percentile) indicates that mass exploitation has not yet materialized, likely because Quentn WP is a niche plugin with limited global install base - even a mid-sized municipal IT team in gdynia running a Quentn-integrated WordPress site may not appear on mass-scanner radar, yet would be fully at risk if exposed. The existence of a publicly available exploit via WPScan meaningfully raises the near-term exploitation likelihood beyond what the EPSS score alone suggests, as automated WordPress vulnerability scanners routinely weaponize WPScan-published PoCs. The lack of CISA KEV listing is consistent with the targeted rather than widespread exploitation posture implied by the low EPSS. The I:N/A:N vector confirms this is a pure data-exfiltration vector with no write or disruption capability, but full database read access on a WordPress installation typically includes password hashes and application secrets. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP GET or POST request to the WordPress installation targeting the vulnerable Quentn WP plugin endpoint, embedding SQL metacharacters and injection payloads in the affected request parameter. The plugin passes the input directly into an unprepared SQL query, allowing the attacker to append UNION-based or blind time-based SQL clauses that return arbitrary rows from the WordPress database, including wp_users password hashes and plugin configuration secrets. A publicly available PoC via WPScan lowers the skill threshold to near-automated exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
RemediationAI
Update the Quentn WP plugin to version 1.2.15 or later, which contains the vendor-released patch. The fix is referenced in the WPScan advisory at https://wpscan.com/vulnerability/527a59cf-c7a3-4cf0-85f2-378c62eb7fce/. Administrators unable to update immediately should deactivate the plugin entirely until patching is possible, as no safe partial workaround exists for a raw SQL injection in an unauthenticated endpoint - disabling the plugin removes the attack surface while preserving the rest of the WordPress installation. Additionally, review web application firewall rules to detect and block SQL injection attempts targeting WordPress plugin endpoints, though WAF bypass is common for simple SQLi payloads and should not substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Quentn WP plugin (CPE: cpe:2.3:a:unknown:quentn_wp:*:*:*:*:*:*:*:*) is a WordPress integration plugin for the Quentn marketing automation platform. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: the plugin concatenates or interpolates user-supplied input directly into a SQL query string without using prepared statements or parameterized queries, and without escaping special SQL metacharacters. Because WordPress exposes plugin endpoints to unauthenticated HTTP clients, and because the parameter in question is accessible without authentication, exploitation requires only network access. The S:C scope change in the provided CVSS vector reflects that successful exploitation affects the MySQL/MariaDB database server - a component outside the plugin's own authorization scope.
Know when Quentn Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable unauthenticated endpoint; scope change to database justified; read-only impact so I:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.
Articles & Coverage 1
Technical POC Analysis
The bug is a classic SQL injection (CWE-89).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Quentn WP WordPress plugin versions prior to 1.2.15 contains an unauthenticated SQL injection that exposes the entire WordPress database to unauthorized access, including user credentials and sensitive configuration. Any organization using WordPress with this plugin installed is at immediate risk of credential theft and unauthorized data access; exploitation is trivial with publicly available attack code.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators)
The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extr
Exploit-DB