EUVD-2026-96790
GHSA-xwx7-jj6g-vhp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Post Voting System
-
ExploitSend crafted request with malicious parameter
-
ExecutionTrigger unsanitized SQL query
-
ImpactExtract database contents (users, hashes)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond the plugin being installed - the flaw is reachable by remote, unauthenticated users (AV:N/PR:N/UI:N) against affected installations of the Post Voting System WordPress plugin version 1.0 and earlier, via an unsanitized request parameter used directly in a SQL query. The primary limiting factor is deployment: the target site must have this specific, niche plugin active; there is no reported dependency on a non-default setting or on authentication. No fixed version is confirmed in the available data, so mitigation currently relies on removing or restricting the plugin. |
| Impact | Multiple signals point to a genuine priority rather than an inflated high-CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which is the worst-case access profile, and CWE-89 SQL injection is highly reliable to exploit. A public exploit exists (WPScan vulnerability entry), raising practical risk well above a theoretical finding. Against that, no CISA KEV listing and no EPSS score were provided, so there is no evidence of active in-the-wild exploitation and no modeled exploitation-probability signal to corroborate urgency - treat likelihood as 'plausible and easy' rather than 'confirmed widespread.' One internal inconsistency worth noting: the input CVSS sets S:C (scope changed) and C:H/I:N/A:N, which is unusual for a classic SQLi where injection typically affects the same database authority and often permits at least some integrity impact; the scope-changed/confidentiality-only shape should be verified against the vendor advisory. SSVC-style framing: exploitation = public PoC (not active), automatable = likely yes (unauthenticated network SQLi is easily scripted), technical impact = partial-to-total on the database. Net: patch/mitigate promptly on any affected install, but the realistic blast radius is bounded by the product's small deployment footprint. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Post Voting System ≤1.0, injecting SQL through an unsanitized parameter to read arbitrary database contents such as user records and password hashes. Because a public exploit is already available via WPScan and the CVSS vector requires no authentication, complexity, or user interaction, the attack can be automated and mass-scanned across exposed sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
RemediationAI
No vendor-released patch is identified at time of analysis - no fixed version is confirmed in any of the supplied data, and the plugin currently appears unmaintained (the CPE vendor field is "unknown"). The most reliable action is to deactivate and uninstall the Post Voting System plugin; if voting functionality is business-critical, the only safe interim posture is restrictive: place the site behind a WAF or reverse proxy rule that virtual-patches the injection (blocking requests carrying SQL metacharacters such as quotes, comment sequences, or UNION/SELECT keywords to the plugin's endpoints), and restrict or rate-limit anonymous traffic to whatever AJAX/REST route the plugin registers. Note that pattern-based WAF filtering produces false positives on legitimate vote submissions and is bypassable with encoding tricks, so it should be treated as a stopgap only. Consider reducing blast radius by ensuring the WordPress database user has no privileges beyond those required for the site and by rotating database credentials and salts if compromise is suspected, since the readable data includes hashed user credentials. Monitoring guidance: review the WPScan advisory page (https://wpscan.com/vulnerability/27dda3f8-1221-4710-bced-229577d20977/) and the VulDB entry (https://vuldb.com/vuln/416541) for a fixed release, and otherwise treat the plugin as end-of-life.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic SQL injection (CWE-89) in a WordPress plugin that handles post voting. A user-supplied request parameter is concatenated into a SQL statement - most likely a query issued through WordPress's database abstraction layer ($wpdb) - without use of $wpdb->prepare(), casting, or escaping, letting an attacker alter the query's structure. Because the parameter is processed before any capability or nonce check that would require a logged-in user, the injection point is reachable by anonymous visitors (CVSS vector PR:N/UI:N, network-reachable). The CPE data (cpe:2.3:a:unknown:post_voting_system) shows the vendor field is unresolved in NVD, and EUVD lists the affected range as Post Voting System 0 through 1.0, confirming that all released versions to date are in scope. The authoritative assessment rates the vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning the compromise stays within the application's own security scope rather than crossing an isolation boundary - the realistic outcome is unauthorized read of stored data (including WordPress user hashes, salts, and any sensitive content in the database) rather than code execution.
Know when Post Voting System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi gives AV:N/AC:L/PR:N/UI:N and C:H for data disclosure; scope kept S:U as injection stays within the DB authority, and I/A left N per the reported impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Technical POC Analysis
CWE-89 (SQL Injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations using the WordPress Post Voting System plugin (version 1.0 and earlier) face a high-severity SQL injection vulnerability that could allow attackers to read the site's database, potentially exposing sensitive user or business data. While the plugin is niche, any organization with it active is at risk, and publicly available exploit code makes mass scanning likely. With no vendor-released patch identified, leadership must prioritize immediate mitigation to avoid data breaches and associated compliance and reputational consequences.
Remove or disable the Post Voting System plugin; deploy virtual patching via WAF to block SQL injection attempts; monitor database and web logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB