EUVD-2026-100860
GHSA-v47c-mj7g-mcvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Fast Courier < 5.2.4
-
ExploitSend crafted request to unauthenticated REST route
-
ExecutionInject SQL via unsanitized parameter
-
ImpactExfiltrate arbitrary data from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only against sites running the Fast Courier WordPress plugin at a version in the range 5.0.0 up to (but not including) 5.2.4, where the vulnerable unauthenticated REST route is registered and reachable. No authentication, credentials, or user interaction are required (PR:N/UI:N), and default installations are affected because the REST route is exposed without an auth check. The practical limiting factor is product scope: the target must have this specific, relatively niche plugin installed and active, and must not have upgraded to 5.2.4; impact is limited to reading database data (no write/modify or availability loss per I:N/A:N). |
| Impact | Signals are moderately consistent and point to a genuine but not emergency-level priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a fully remote, low-complexity, unauthenticated attack reachable over the network via a REST route, which is the primary driver of the 8.6 base score, and publicly available exploit code (WPScan) lowers the barrier to entry. However, EPSS is only 0.21% (11th percentile), indicating low observed/predicted exploitation volume at present, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Impact is read-only confidentiality (C:H, I:N, A:N) - data disclosure such as credentials, PII, or secrets from the WordPress database - not code execution or defacement. The input vector asserts S:C (scope change), which is debatable for a database-read SQLi confined to the application's own datastore; this inflates the score and should be verified (see assessed vector below). Net: a real, patch-now issue for anyone running the affected plugin because exploit code exists and no authentication is needed, but the low EPSS, absence from KEV, and read-only impact place it below RCE/actively-exploited flaws in triage. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the plugin's exposed REST API route, injecting SQL through an unsanitized parameter that is concatenated into a database query. Because publicly available exploit code exists and no authentication or user interaction is required, the attacker extracts sensitive data (e.g., user records, password hashes, session or API secrets) directly from the WordPress database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
RemediationAI
Upgrade the Fast Courier plugin to 5.2.4 or later, the version in which the vendor addresses the unsanitized SQL input on the unauthenticated REST route; this is the only complete fix and should be applied as a priority on any site still running 5.0.0 through 5.2.3, with the WPScan advisory (https://wpscan.com/vulnerability/8b651892-fc8a-4c8b-a04d-5c76b5b85577/) and EUVD entry EUVD-2026-100860 used to confirm version coverage. If immediate upgrade is not possible, the most effective compensating control is to deactivate the Fast Courier plugin until patched - this removes the vulnerable REST route entirely, at the cost of losing its courier functionality. Alternatively, restrict access to the plugin's /wp-json/ REST namespace at the web server or WAF layer (deny rules or a virtual patch blocking SQL metacharacters in the route's parameters); the trade-off is that legitimate REST calls from the plugin's own front-end may also be blocked, and generic blocking can be bypassed by encoding variations, so it is a stopgap rather than a substitute for patching. Because the flaw permits read-only database access (I:N/A:N, no write or availability impact), also treat any window of exposure as a data-confidentiality incident: review database-resident secrets such as password hashes and API keys in wp_users/wp_options and rotate those that could be exposed. No vendor patch gap exists here - the fix is released - and there is no confirmed active exploitation to date, so remediation should be prioritized by whether the plugin is actually installed rather than by emergency-response timelines.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (SQL Injection): the plugin takes a value supplied through one of its WordPress REST API endpoints and interpolates it into a SQL statement without sanitization or escaping, so attacker-controlled input reaches the database engine as query syntax. In the WordPress ecosystem this typically means a route registered via register_rest_route() with a permissive permission_callback (effectively open to anonymous callers) and a query built through $wpdb without $wpdb->prepare() or equivalent parameter binding, allowing union/boolean/error-based extraction of arbitrary tables such as wp_users and wp_usermeta. The supplied CPE string (cpe:2.3:a:unknown:fast_courier:*:*:*:*:*:*:*:*) records the component as the 'fast_courier' plugin but does not resolve a vendor namespace, which is common for WordPress plugin CPEs and is why the EUVD record instead pins the affected range as Fast Courier 5.0.0 < 5.2.4. The vulnerable surface is the REST route itself rather than an administrative page, which is what makes the issue reachable without authentication; note that our independent assessment scores the vector as S:U (no scope change) rather than the S:C in the supplied CVSS 8.6 vector, consistent with database read-only impact confined to the WordPress application.
Know when Fast Courier gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Remote unauthenticated REST injection (AV:N/AC:L/PR:N/UI:N) yielding arbitrary read (C:H, I:N/A:N); scope assessed Unchanged as the read stays within the application database, unlike the input's S:C.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Executive ViewAI
The Fast Courier WordPress plugin, versions 5.0.0 through 5.2.3, exposes affected WordPress sites to unauthenticated database read access, meaning an external attacker could view stored site data without credentials. Because a vendor patch (5.2.4) is available and publicly available exploit code exists, leadership should ensure rapid inventory and remediation for any business-critical or customer-facing WordPress properties using this plugin. The issue is confidentiality-only and has no CISA KEV listing, but exposed data could include customer, order, or credential-related records, making it a priority for affected site owners.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB