EUVD-2026-96780
GHSA-j26v-2f6c-4g64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Site Setup Wizard ≤1.5.8
-
ExploitSend crafted request with malicious SQL parameter
-
ExecutionTrigger unauthenticated SQL injection
-
ImpactExfiltrate database records (users, hashes)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that a target WordPress site have the Site Setup Wizard plugin installed and active at version 1.5.8 or earlier, with the vulnerable parameter-handling code path reachable over HTTP. Per CVSS AV:N/AC:L/PR:N/UI:N, there are no authentication, user-interaction, or special-configuration prerequisites - any publicly reachable installation of the affected version is exploitable by default. The practical limiting factor is deployment footprint: exploitation depends entirely on this specific, relatively uncommon plugin being present; the flaw also enables data read only (C:H, I:N, A:N), so it does not by itself permit data modification or site takeover. |
| Impact | This is a credible, actionable priority for any environment running the affected plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction - the most dangerous combination for internet-facing WordPress sites. A public exploit is confirmed available (WPScan), which materially raises likelihood versus a theory-only bug. However, note two caveats: (1) No EPSS score and no CISA KEV listing were provided, so there is no evidence of active, widespread exploitation yet - the signals indicate high exploitability, not confirmed in-the-wild attacks. (2) The input CVSS asserts Scope Changed (S:C), which inflates the score to 8.6; for a read-only SQL injection (C:H/I:N/A:N) that stays within the same database authority, S:U is more defensible and would yield 7.5 - verify scope rationale with the vendor. Overall: real priority due to unauthenticated network exploitability plus public PoC, but risk is read/confidentiality-only (no integrity or availability impact claimed). |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint, injecting SQL through the unsanitised parameter to extract WordPress database contents such as user records and password hashes. A public exploit exists (published via WPScan), so exploitation requires little custom development, and the low-complexity network vector (AV:N/AC:L) means it can be automated at scale against exposed sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
RemediationAI
No fixed version is identified in the available data, so the primary action is to deactivate and delete the Site Setup Wizard plugin from every WordPress installation that no longer needs it - as a setup wizard it is normally required only during initial site configuration, so removing it after setup is complete costs nothing functionally while eliminating the entire attack surface; this is the recommended path given the unmapped "unknown" vendor field in the CPE, which suggests upstream maintenance is uncertain. If the plugin must remain installed, apply compensating controls: block HTTP access to the plugin's directory and files at the web server or reverse proxy (e.g., deny requests matching /wp-content/plugins/site-setup-wizard/), noting the trade-off that legitimate wizard functionality will break for anyone who needs it; and/or deploy a WAF rule targeting SQL metacharacters in requests to that plugin, accepting that virtual patching may miss encoding tricks and does not fix the underlying flaw. Restrict the plugin to trusted administrative IPs if it is still in active use, and monitor for a patched release via the WPScan advisory (https://wpscan.com/vulnerability/fdc222cf-8056-47c5-99a3-f0c928dfc1f8/) and the VulDB entry (https://vuldb.com/vuln/416532) before reinstalling. Because the vulnerability permits database reads, treat any site that ran an affected version as potentially compromised: review web and database logs for anomalous SELECT/UNION patterns, and rotate WordPress database credentials, authentication salts and any secrets stored in wp_options, since publicly available exploit code exists for this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-89 SQL injection in a PHP-based WordPress plugin: a user-supplied request parameter is concatenated into a SQL statement without proper sanitisation or escaping (i.e., without prepared statements via $wpdb->prepare(), proper casting, or escaping), letting the attacker alter query structure and use UNION/boolean/error-based techniques to exfiltrate arbitrary rows. The affected component is the Site Setup Wizard plugin (CPE cpe:2.3:a:unknown:site_setup_wizard:*:*:*:*:*:*:*:*), and EUVD records affected versions as "Site Setup Wizard 0 ≤1.5.8". WPScan is the reporting source, and the linked WPScan entry is tagged as exploit material. Note a scoring discrepancy worth flagging to asset owners: the provider score of 8.6 uses CVSS:3.1 with Scope:Changed, whereas our independent assessment uses Scope:Unchanged (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which is the more conservative read because the injection affects only the backing database served by the same WordPress application rather than crossing a security authority boundary. Both vectors agree on the essentials: network reachable, low complexity, unauthenticated, no user interaction, high confidentiality impact only. The CPE's vendor field is recorded as "unknown", which is often a sign of a plugin with no clearly mapped or actively maintained upstream vendor - relevant because it makes an authoritative patch announcement less certain.
Know when Site Setup Wizard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) reading data gives C:H but I:N/A:N; scope stays Unchanged (S:U) as the injection remains within the database's own authority.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
Technical POC Analysis
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations running the Site Setup Wizard WordPress plugin through version 1.5.8 are exposed to a SQL injection flaw that allows remote attackers to read sensitive database contents, including password hashes and configuration secrets. Publicly available exploit code exists and no vendor-released patch identified at time of analysis, so affected sites face immediate risk of credential theft and further compromise. Leadership should prioritize identifying and mitigating vulnerable installations to protect user data and maintain trust.
No vendor patch available; interim mitigations include disabling or removing the vulnerable plugin, applying virtual patching via web application firewall, restricting network access to affected sites, and monitoring for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB