Bluff Post CVE-2026-89237

No authentication and no user interaction required: exploitation works against a default installation of the Bluff Post WordPress plugin at any version through 1.1.1, where an attacker-supplied parameter is used unsanitized as a SQL identifier. The main limiting factor is attack complexity (AC:H): because the sink is a SQL identifier rather than a quoted value, standard quote-breaking/UNION injection does not apply and the attacker must use blind or inference-based extraction, making reliable data exfiltration slower and more involved. Impact is confidentiality-only (read access to database contents); no integrity or availability effect is indicated.

Signals are consistent and point to a real but low-urgency issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, base 6.8) describes an unauthenticated, network-reachable SQL injection with high attack complexity and confidentiality-only impact. The AC:H is credible: because the untrusted input is used as a SQL identifier rather than a quoted value, extraction typically requires blind/inference techniques rather than a simple UNION, which raises the bar. EPSS is very low (0.17%, 6th percentile) and CISA SSVC returns Exploitation:none, Automatable:no, Technical Impact:partial - all indicating no observed exploitation and non-trivial automation. Publicly available POC exists (WPScan), but POC availability is NOT the same as active exploitation, and this CVE is not in CISA KEV. Net: a genuine unauthenticated data-disclosure flaw worth patching, but not an emergency - the combination of high complexity, niche product, confidentiality-only impact, and no exploitation evidence keeps real-world priority LOW-MEDIUM. One point to verify with the vendor: S:C (scope change) is asserted in the input vector, which is a contestable choice for a typical SQLi that reads the same database the plugin already uses (see assessed vector below).

A remote, unauthenticated attacker sends a crafted HTTP request to the Bluff Post plugin (≤1.1.1) supplying a malicious value in a parameter that is concatenated into a SQL query as an identifier, appending attacker-controlled SQL. Because the injection point is an identifier rather than a quoted value, the attacker uses blind/inference techniques to extract sensitive database contents such as WordPress user records and secrets. Public POC/exploit detail is available via WPScan, lowering the effort to reproduce.