What is the CVSS score of CVE-2026-8978?

CVE-2026-8978 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OptinCraft CVE-2026-8978

EUVD-2026-34955 MEDIUM

SQL Injection (CWE-89)

2026-06-06 Wordfence

GHSA-pq3p-m3ch-rgpc

SQLi WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:52 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 4.9

DescriptionCVE.org

The OptinCraft - Drag & Drop Optins & Popup Builder for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in OptinCraft (Drag & Drop Optins & Popup Builder for WordPress) versions up to and including 1.2.0 allows authenticated attackers with administrator-level access to extract sensitive data from the underlying WordPress database. The vulnerability exists in the 'order_by' parameter, which is passed without sufficient escaping or parameterized query preparation through the plugin's internal SQL compiler, enabling appending of arbitrary SQL to existing queries. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high confidentiality impact and network-accessible attack vector make it a meaningful data-disclosure risk in multi-administrator WordPress environments.

Technical ContextAI

The affected product is identified via CPE as cpe:2.3:a:crafium:optincraft_-_drag_&_drop_optins_&_popup_builder_for_wordpress:*:*:*:*:*:*:*:* - the OptinCraft plugin by Crafium, installed on WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Source code references pinpoint three specific files: the SQL query compiler at vendor/vendor-src/wpmvc/database/src/Query/Compilers/Compiler.php line 286, the CampaignRepository at app/Repositories/CampaignRepository.php line 55, and the admin CampaignController at app/Http/Controllers/Admin/CampaignController.php line 37. The plugin uses a third-party wpmvc database abstraction layer whose Compiler class fails to sanitize the order_by value before interpolating it into SQL, bypassing WordPress's standard $wpdb->prepare() protections. This is a classic second-order-style injection through a query builder that treats ordering columns as trusted input.

RemediationAI

An upstream fix appears to have been committed to the WordPress Plugin SVN repository as referenced in changeset 3554161 (https://plugins.trac.wordpress.org/changeset?old=3554161%40optincraft&new=3554161%40optincraft); however, the exact patched release version number is not independently confirmed from available data - verify the current plugin version in the WordPress Plugin Directory and update to any release newer than 1.2.0 once available. Site administrators should check the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f28a95b0-0f7d-43c4-acf9-13c561245f4b for patch confirmation. As a compensating control prior to patching, restrict WordPress administrator account access to the minimum necessary set of users, enforce strong credentials and MFA on all admin accounts, and consider deploying a Web Application Firewall (such as Wordfence's own firewall) with SQL injection ruleset enabled to intercept malicious order_by payloads - note that WAF rules may not catch all injection variants and should not substitute for patching. Disabling the OptinCraft plugin entirely until a confirmed patched version is available is the safest compensating control with the trade-off of losing campaign and popup functionality.