EUVD-2026-74715
GHSA-3ggh-2cgw-hc27
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Admin-only access (PR:H) required; read-only SQL impact (C:L, I:N, A:N); S:C retained as query crosses into shared WordPress DB scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.
AnalysisAI
Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators) to execute arbitrary SQL queries against the underlying database via an unsanitized parameter. Although the attack vector is network-accessible and no authentication bypass is needed, exploitation is constrained to administrators, significantly limiting real-world risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator account on the target site and the Quentn WP plugin installed and active in a version prior to 1.2.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially lower than a raw scope-changed CVSS vector might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 1.2.15 of the Quentn WP plugin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract
The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today