EUVD-2026-96784
GHSA-59r4-7hfh-h3r4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP-Partner ≤1.2.1
-
ExploitSend crafted request with injected SQL
-
ExecutionAppend UNION/stacked query
-
ImpactExtract and exfiltrate sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated SQL injection against default configurations of the WP-Partner WordPress plugin at any version through 1.2.1, requiring only that the plugin be installed and active and the vulnerable parameter/endpoint be reachable over HTTP(S). Limiting factors that reduce realistic risk: exploitation is confined to sites actually running this specific, low-footprint plugin; impact is limited to confidentiality/data disclosure with no direct integrity or availability effect per the CVSS vector; and no authentication or user interaction is needed (PR:N/UI:N), so there is no credential barrier to slow attackers. |
| Impact | Signals converge on a genuine high-priority issue for the specific sites running this plugin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) describes a remotely reachable, low-complexity, unauthenticated SQL injection with high confidentiality impact and a scope change but no integrity or availability impact - consistent with a read-only union/stacked-query data-extraction flaw. A public exploit exists (reported by WPScan), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score in the input, so active or widespread exploitation is NOT confirmed - POC availability and active exploitation are distinct signals. The main dampening factor is prevalence: WP-Partner is an obscure plugin (vendor literally labelled 'unknown'), so the real-world blast radius is small even though per-install risk is high. One inconsistency to verify: the input vector uses S:C (scope changed), defensible for SQLi reaching a separate database component but not universally applied - my independent assessment treats scope as unchanged, which lowers the effective base score; confirm the scope interpretation with the WPScan advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the vulnerable WP-Partner endpoint, injecting SQL through an unsanitised parameter to append an additional query. Because publicly available exploit code exists (WPScan), this requires minimal skill to reproduce, allowing extraction of WordPress user credentials, session tokens, or other sensitive database contents. The network attack vector and low complexity (AV:N/AC:L) mean no special positioning or timing is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
RemediationAI
No vendor-released patch is identified in the available data at time of analysis - the WPScan disclosure and the VulDB entry document the flaw but do not point to a fixed version, so there is no confirmed upgrade target to cite. The most reliable immediate action is to deactivate and delete WP-Partner from all WordPress installations, accepting the loss of whatever functionality the plugin provided; if the plugin is business-critical, take the site offline or place the vulnerable endpoint behind authentication until a fix appears. As a compensating control, deploy virtual patching at the WAF or reverse proxy to block SQL metacharacters and UNION/boolean-based patterns on requests to the plugin's routes - this is effective against commodity exploitation but can be bypassed by encoding tricks and will generate false positives on legitimate traffic, so it should not be treated as a substitute for removal. Additionally, restrict access to the vulnerable path by IP allowlisting or basic authentication where the endpoint is only needed internally (trade-off: breaks any public-facing feature), audit the WordPress database for signs of unauthorised reads or dumped credential tables, rotate administrator passwords and salts on any site that ran an affected version, and monitor the WPScan and VulDB advisories for a patched release. This issue is unauthenticated and has publicly available exploit code, so remediation should be prioritised on any internet-facing site where the plugin was active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP-Partner is a WordPress plugin written in PHP that builds database queries directly against the WordPress MySQL/MariaDB backend. Per the WPScan report, a request parameter is consumed without sanitisation or escaping and is concatenated into a SQL statement instead of being passed through WordPress's parameterised query helpers ($wpdb->prepare() or equivalent). This is the classic CWE-89 injection pattern: because attacker-controlled input reaches the SQL parser as query syntax rather than as data, a remote party can terminate the intended statement and append additional SELECT/UNION constructs to read arbitrary tables. The vulnerability is reachable pre-authentication (CVSS vector PR:N, UI:N, AV:N), so no WordPress account, cookie, or nonce is required - only network access to the vulnerable route. The supplied CPE string (cpe:2.3:a:unknown:wp-partner:*:*:*:*:*:*:*:*) records the package name but no mapped vendor namespace and no version ceiling, while EUVD enumerates the affected range as WP-Partner version 0 through 1.2.1; the effective constraint is therefore 'plugin installed, active, and version <= 1.2.1'. The official NVD-style vector scores scope as changed (S:C) whereas the independent assessment treats scope as unchanged (S:U), so impact should be read as data disclosure rather than a demonstrated pivot into other security authorities.
Know when Wp Partner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi gives AV:N/AC:L/PR:N/UI:N; read-only data extraction yields C:H, I:N, A:N; I treat the database as the same security authority, so S:U rather than the input's S:C.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Technical POC Analysis
CWE-89 (SQL Injection / OWASP A1).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The WP-Partner WordPress plugin, versions through 1.2.1, contains an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data, including user credentials and hashes, from any affected site. Organizations running this plugin are exposed to data breach risks that could lead to credential compromise, lateral movement, and regulatory penalties. Leadership should prioritize identifying and mitigating exposed instances, as publicly available exploit code exists and no vendor-released patch has been identified at this time.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the WP-Partner plugin (all versions through 1.2.1); if operationally required, implement WAF rules to detect and block SQL injection patterns on the plugin's endpoints, restrict network access to trusted IPs, enable detailed logging and alerting for anomalous database queries, and rotate credentials if any indication of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB