EUVD-2026-96786
GHSA-47qp-63h4-6hgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Datalist it plugin
-
DeliverySend crafted request to vulnerable parameter
-
ExploitInject SQL via unsanitized input
-
ExecutionDatabase executes attacker query
-
ImpactExfiltrate arbitrary database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated SQL injection against default configurations of the Datalist it WordPress plugin version ≤0.0.3; the only prerequisite is that the plugin is installed and active on a network-reachable WordPress site, and the vulnerable request parameters are reachable by anonymous users (PR:N/UI:N confirm no authentication or user interaction). The primary limiting factor is reach, not difficulty: the plugin appears to have a very small install base, so realistic exposure is confined to the few sites actually running it. No non-default configuration, platform-specific condition, or elevated privilege is required. |
| Impact | Multiple signals align toward a genuine, actionable web-application risk but tempered by product obscurity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 8.6) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction - the easiest class of attack to automate and mass-scan. POC availability is confirmed (publicly available exploit code exists via WPScan), which raises the practical likelihood of opportunistic scanning against exposed WordPress sites. However, there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of confirmed active exploitation, and real-world exploitation volume cannot be quantified from the data given. The vector's S:C (scope changed) and C:H/I:N/A:N indicate a read-only confidentiality breach (data disclosure via SQL injection) rather than code execution or integrity/availability damage; I assess the scope claim as arguable for a read-only SQLi and would independently score it S:U (see assessed vector). Net: this is a real priority for anyone running the specific plugin because it is trivially exploitable and has public exploit code, but the overall population impact is bounded by the plugin's apparently small install base. EPSS and KEV data are MISSING/absent - verify current KEV and EPSS before finalizing prioritization. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running the Datalist it plugin (≤0.0.3) and sends a crafted HTTP request supplying a malicious value in one of the unsanitized request parameters. Because the input is concatenated directly into a SQL query, the attacker extracts sensitive database contents such as user records and password hashes. Public exploit code from WPScan lowers the skill barrier and enables scripted mass-scanning against exposed sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
RemediationAI
No vendor-released patch or fixed version is identified in the available data; absence of a patch reference is not confirmation that none exists. The primary mitigation is to deactivate and remove the Datalist it plugin from affected WordPress installations until an update beyond 0.0.3 is published and confirmed by the vendor. If removal is not immediately possible, place the site behind a web application firewall configured with SQL injection virtual patching rules, alert on SQLi attempts, and monitor database and web logs for anomalous queries, accepting that WAF rules can cause false positives and may be bypassed by determined attackers. Restrict network reachability to the WordPress site where feasible and review the WPScan advisory at https://wpscan.com/vulnerability/27135434-79e0-4f9e-aecf-c7092faec29b/ and VulDB entry at https://vuldb.com/vuln/416537 for updates before re-enabling the plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in SQL commands. Datalist it fails to sanitize and escape several request parameters before using them to build a SQL query, so anonymous HTTP requests can alter the query structure and retrieve arbitrary data from the WordPress database. The provided CPE, cpe:2.3:a:unknown:datalist_it:*:*:*:*:*:*:*:*, identifies the plugin under an unknown or unattributed vendor and EUVD lists affected versions as Datalist it 0 through 0.0.3. The assessed vector AV:N/AC:L/PR:N/UI:N confirms remote, low-complexity exploitation with no authentication or user interaction; independent assessment treats scope as unchanged (S:U) and impact as C:H/I:N/A:N, meaning the actionable and confirmed effect is confidentiality loss rather than integrity or availability impact. The NVD-style vector in the raw data shows S:C, but the authoritative assessment scopes the issue as unchanged, so analysis should not claim data modification, denial of service, or code execution from this SQL injection.
Know when Datalist It gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi with no user interaction (AV:N/AC:L/PR:N/UI:N); read-only data disclosure gives C:H, I:N, A:N, and I assess S:U as the DB is the vulnerable component itself.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Technical POC Analysis
Class: CWE-89, Improper Neutralization of Special Elements used in an SQL Command (SQL injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Datalist it plugin for WordPress, through version 0.0.3, contains a high-severity SQL injection flaw that lets attackers run arbitrary queries against a site's underlying database and read the data stored there, including user records and other sensitive content. Publicly available exploit code exists and no vendor patch has been released, so exposure persists for as long as the plugin remains active and reachable on an internet-facing site. Because this is a third-party plugin with an apparently limited install base, the primary organizational risk is concentrated in any team or business unit that has deployed it without centralized plugin governance or an inventory of what runs on its WordPress estates.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and uninstall the Datalist it plugin from all WordPress instances, or take affected sites offline where removal is not immediately possible; apply WAF or reverse-proxy virtual patching rules to block SQL injection attempts against plugin endpoints; restrict site and administrative access to trusted networks; and enable database and web server logging with alerting to detect unauthorized query activity or data exfiltration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB