BSK PDF Manager CVE-2026-91074

Requires an authenticated WordPress account with contributor-level capabilities or higher on a site running BSK PDF Manager through 3.8.1; the attacker then supplies malicious input to the specific unsanitised, unescaped plugin parameter used in a SQL statement. Limiting factors: exploitation is gated on holding a valid low-privilege account, so sites that do not permit untrusted user registration or do not grant contributor access to outsiders face substantially reduced exposure. Impact is confidentiality-only (database read, including admin password hashes); no data modification or denial of service is described.

This is a moderate-severity, authenticated SQL injection (CWE-89) in the BSK PDF Manager WordPress plugin. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, 6.8) indicates network reachability, low complexity, no user interaction, and a confidentiality-only impact with scope change - consistent with reading data (e.g. administrator password hashes) beyond the plugin's own scope. However, the vector's PR:H conflicts with the description, which states exploitation only requires 'contributor-level access and above'; a WordPress contributor is a low-privileged authenticated role, so PR:L is more defensible and the real barrier to entry is lower than PR:H implies. No EPSS score, CISA KEV listing, SSVC decision, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net real-world risk is tempered by the authentication requirement (an attacker must already hold a contributor account on the target site), but is elevated by the fact that successful exploitation yields administrator credential hashes, enabling privilege escalation to full site takeover. This is a credible but not emergency priority - prioritize on sites that allow untrusted contributor registrations.

An attacker who holds (or registers/obtains) a contributor-level WordPress account on a site running BSK PDF Manager ≤3.8.1 submits a crafted value in the vulnerable parameter, injecting SQL into a backend query. Because input is not sanitised or escaped, they extract sensitive rows such as the wp_users administrator password hashes, which can then be cracked offline or used to pivot to admin. No public exploit code is identified in the provided data, and no user interaction is required.