EUVD-2026-31044
GHSA-xxj3-cp34-3h25
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Unauthenticated SQL injection in the PixelYourSite Boost plugin for WordPress (versions up to and including 2.0.3) allows remote attackers to extract sensitive database contents via time-based blind SQLi in the 'current_url' and 'user_name' parameters. Wordfence reported the issue with a CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue rooted in WordPress plugin database access patterns. The Boost plugin (CPE cpe:2.3:a:pixelyoursite:boost) concatenates user-supplied 'current_url' and 'user_name' parameters into SQL statements without using $wpdb->prepare() placeholders or wpdb::esc_like()/esc_sql() sanitization. Because the injection is time-based blind, exploitation relies on conditional SLEEP()/BENCHMARK()-style payloads to infer data one bit at a time from the underlying MySQL/MariaDB backend that WordPress relies on.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data; site operators should monitor https://www.pixelyoursite.com/boost-plugin and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1cac2397-bb38-40d6-b90d-68e3ea136267?source=cve for a release beyond 2.0.3 and upgrade immediately when available. In the interim, deactivate and remove the Boost plugin if it is not business-critical (side effect: loss of plugin functionality such as conversion tracking/pixel features), or place the WordPress site behind a WAF such as Wordfence/Cloudflare with rules blocking SQL metacharacters and time-function payloads (UNION, SLEEP, BENCHMARK) in the 'current_url' and 'user_name' request parameters (side effect: potential false positives on legitimate URLs containing reserved characters). As a defense-in-depth measure, restrict the database user used by WordPress to least-privilege SELECT on its own schema to limit the blast radius of any successful extraction.
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
PHP Object Injection in the Boost plugin for WordPress (versions up to and including 2.0.3) allows unauthenticated remot
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets re
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated a
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain i
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today