EUVD-2026-88094
GHSA-m89f-xjqg-7r4m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
ExploitSend crafted parameter to plugin endpoint
-
ExecutionInjected input breaks out of SQL query
-
ImpactRead or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a running instance of the Post Voting System WordPress plugin at version ≤1.0 and a valid low-privilege authenticated account (PR:L) - practically exploitable at scale only where open user registration is enabled, since some authenticated session is mandatory. No user interaction is needed (UI:N) and no special non-default plugin configuration is indicated by the description. Limiting factors: the authentication requirement gates opportunistic mass exploitation, the plugin is niche/rarely deployed, and impact is bounded (partial confidentiality/integrity, no availability impact). |
| Impact | This is a genuine but modest-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a low-complexity, network-reachable SQL injection requiring only low-privilege authentication (PR:L) - in a WordPress context that typically means any registered account, including self-registered subscribers if open registration is enabled. Public exploit/detail exists via WPScan, so exploitation is technically trivial for anyone with an account. However, the impact is constrained: vendor-rated C:L/I:L/A:N and SSVC 'Technical Impact: partial' point to limited data read/modify rather than full database compromise or RCE. SSVC also reports Exploitation: none (no observed active exploitation) and Automatable: no, and there is no CISA KEV listing and no EPSS score supplied. The signals are consistent rather than conflicting: real and exploitable, but a bounded, authentication-gated data-integrity/confidentiality issue in a niche plugin - not a mass-exploitation priority. Note the scope flag S:C in the vendor vector is debatable for a same-database SQLi (see assessed vector); no EPSS value was provided, so probabilistic exploitation likelihood could not be cross-checked. |
| Exploit ScenarioDerived | An attacker holding any low-privilege authenticated WordPress account on a site running Post Voting System ≤1.0 submits a crafted value in the vulnerable parameter, which is concatenated into a SQL query, letting them extract or alter database contents (e.g. other users' data or post/vote records). A public write-up with exploitation detail is available from WPScan, lowering the skill required. Low complexity (AC:L) and no user interaction mean the request can be replayed or scripted once an account is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
SQL injection in the Post Voting System WordPress plugin through version 1.0 allows an authenticated user to inject arbitrary SQL into a database query because an input parameter is neither sanitized nor escaped before use. Any low-privilege account (PR:L per the assessed CVSS vector) is sufficient, so on sites with open user registration the issue is practically reachable at scale, though exploitation is limited by the plugin's niche deployment and by the fact that a valid authenticated session is mandatory. Publicly available exploit code exists, but there is no confirmed active exploitation (SSVC Exploitation: none), so this should be treated as a genuine but modest-severity issue requiring prompt patching rather than emergency response.
RemediationAI
Replace or remove the vulnerable plugin: because no fixed version is identified in the available data, the safest immediate action is to deactivate and uninstall Post Voting System through 1.0 on any production site, accepting the loss of voting functionality, or replace it with a maintained alternative. If the plugin must remain temporarily, restrict exposure by disabling open user registration and reviewing existing low-privilege accounts, since the assessed vector requires an authenticated session (PR:L) - this shrinks the pool of potential attackers but does not eliminate the SQL injection for legitimate logged-in users. Additional compensating controls include placing the site behind a WAF with SQL injection rules tuned to the plugin's endpoints, and monitoring database and web logs for anomalous query patterns or unexpected UNION/SLEEP-style payloads; note that WAF bypasses are common for plugin-specific injection points and that these controls are temporary mitigations, not fixes. Track the WPScan advisory at https://wpscan.com/vulnerability/dbe62e96-6493-4385-92a2-6281c5428a9f/ and the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-89303 for a vendor-released patch; no vendor-released patch is identified at time of analysis, and publicly available exploit code exists, so prioritize removal over indefinite monitoring.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in a WordPress plugin: a request parameter reaches a SQL query without parameterization, prepared statements, or escaping (e.g., via $wpdb->prepare or esc_sql), letting the attacker alter query logic. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation from an authenticated context with no user interaction, and bounded impact - partial confidentiality and integrity loss, no availability impact, and no scope change (the note that the NVD-style vector shows S:C has been superseded by the assessment's S:U scope). The plugin ships as an unauthenticated-registration-friendly voting component, so any site that allows subscribers to register exposes an injected query path to a broad pool of users; sites with closed registration restrict the attack surface to already-provisioned accounts. The CPE identifier cpe:2.3:a:unknown:post_voting_system:*:*:*:*:*:*:*:* reflects that the vendor field is unconfirmed and that all versions up to and including 1.0 are in scope (EUVD likewise lists Post Voting System ≤1.0). The root cause class - missing input validation on a query-building parameter - is the same pattern that makes plugin SQLi bugs trivially automatable once the injection point is known, which is why the availability of public exploit code matters even at moderate severity.
Know when Post Voting System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network SQLi, low complexity, requires a low-privilege account (PR:L); I assess S:U since injection stays within the plugin's own database, with partial confidentiality and integrity impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB