EUVD-2026-96788
GHSA-chf9-25cp-vm32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Loja Automática plugin
-
ExploitSend crafted request with injected SQL
-
ExecutionBackend executes unsanitized query
-
ImpactExtract database contents (users/secrets)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Loja Automática plugin installed and active at version 1.0.0 or earlier, and that the vulnerable parameter/endpoint is network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special privileges, and no user interaction are required - exploitation works against a default installation of the affected plugin. The principal limiting factor is deployment: the plugin is obscure and rarely installed, so realistic exposure depends almost entirely on whether a given site runs this specific plugin rather than on any special configuration toggle. |
| Impact | Multiple signals align on elevated but not top-tier risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is a genuinely dangerous profile, and a public exploit exists (reported by WPScan, listed on wpscan.com), raising the practical likelihood of opportunistic abuse. However, countervailing signals lower the real-world priority: there is NO CISA KEV listing (no confirmed active exploitation) and NO EPSS score was provided, so exploitation probability cannot be quantified from the input. The biggest weighting factor is prevalence - 'Loja Automática' is an obscure WordPress plugin with a tiny install base, so even a public PoC for an unauthenticated SQLi translates to a narrow attack surface in practice. Note also a metric tension: the input vector uses S:C (scope changed) to reach the 8.6 score, which is debatable for a classic in-application SQLi; a more conventional S:U scoring yields ~7.5. Net assessment: a legitimately exploitable flaw worth patching on any affected site, but not a widespread-emergency-class issue given the product's rarity and absence of KEV/EPSS evidence of mass exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint with a malicious value in the unsanitized parameter, injecting SQL that the backend executes against the WordPress database. Because publicly available exploit code exists (via WPScan) and no authentication or user interaction is required, an attacker can automate extraction of sensitive data such as user credentials or secrets. No special privileges or victim interaction are needed, only network reachability of a site running the plugin through version 1.0.0. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
RemediationAI
No vendor-released patch has been identified at the time of analysis: there is no fixed version listed by WPScan, EUVD, or the CVE record, and the plugin's last known release (1.0.0) remains vulnerable. The most reliable remediation is to deactivate and uninstall the Loja Automática plugin from any site where it is installed, then remove its files and verify no leftover endpoints remain; because the plugin is obscure, this is usually practical, and the trade-off is simply the loss of whatever storefront functionality it provided. If the plugin must remain active, compensate with a web application firewall or reverse-proxy rule that blocks SQL injection patterns and specifically restricts requests to the plugin's vulnerable parameter, accepting that signature-based filtering is bypassable, may generate false positives on legitimate traffic, and adds request latency; alternatively, restrict network access to the plugin's endpoints to trusted source addresses via server configuration or an upstream access-control layer. Confirm the deployment footprint first - inventory installed plugins and confirm whether Loja Automática is present and active, since detection is otherwise easy to overlook. Track the WPScan advisory at https://wpscan.com/vulnerability/590abff1-6ffd-48ce-a722-12655ab78a7a/ and the VulDB entry at https://vuldb.com/vuln/416539 for a future fixed release, and until then treat any site running the plugin as exposed to unauthenticated database read access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin: a request parameter is concatenated or interpolated into a SQL statement without sanitization or escaping, so attacker-controlled input alters the query's structure. Because WordPress plugins execute with the database credentials configured in wp-config.php (typically through the $wpdb abstraction), a successful injection generally gives the attacker read access to the WordPress schema, including user records and password hashes in wp_users, secrets in wp_options, and any custom tables created by the plugin or other installed components. CPE data records the affected product as cpe:2.3:a:unknown:loja_automática:*:*:*:*:*:*:*:*, and the EUVD entry lists Loja Automática versions up to and including 1.0.0 as affected, indicating that all released versions of the plugin are vulnerable with no fixed release identified. The assessed vector scores confidentiality as high while integrity and availability are not impacted, matching a read-oriented injection primitive rather than a query that could modify or destroy data.
Know when Loja Autom Tica gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for database disclosure; I assess S:U (classic in-app SQLi) rather than the input's S:C, and set I/A:N as the description cites injection/read only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Technical POC Analysis
Bug class: CWE-89, Improper Neutralization of Special Elements used in an SQL Command (OWASP A1: Injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Any site running the Loja Automática WordPress plugin through version 1.0.0 is exposed to an unauthenticated database read vulnerability for which publicly available exploit code exists and no vendor-released patch has been identified. An attacker needs no credentials, no privileges and no user interaction to extract data directly from the site's backend database, which in a WordPress e-commerce context typically holds customer records, order history, and access credentials. Leadership should care because the affected data is exactly the information that drives breach-notification obligations and customer trust, and mitigation depends entirely on your own teams acting, since no vendor fix is currently available; exposure is concentrated among the limited number of organizations that have this niche plugin installed and active.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Loja Automática plugin until a fix is available; where removal is not immediately possible, deploy WAF/reverse-proxy virtual patching to block SQL injection patterns against the plugin's endpoints; restrict the WordPress database account to least privilege and prevent cross-schema reads; enable and retain detailed web and database query logging and alert on anomalous access to sensitive tables; treat any database readable by the affected application as potentially compromised and monitor for follow-on credential abuse or data-exfiltration indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB