EUVD-2026-84342
GHSA-6p3p-qw9j-cqcr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Blind SQLi needs a high-privilege authenticated account (PR:H); network-reachable with low complexity; DB read gives C:H, S:C reflects the separate database engine, minor A:L, no integrity impact stated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar - WordPress Notification Bar allows Blind SQL Injection.
This issue affects HashBar - WordPress Notification Bar: from n/a through 2.0.3.
Articles & Coverage 1
AnalysisAI
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress session with high privileges (PR:H - an administrator or equivalent role able to reach the affected HashBar parameter) on a site running HashBar - WordPress Notification Bar version 2.0.3 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6) is the only quantitative signal available - there is no EPSS score, no CISA KEV listing, no SSVC decision data, and no public exploit code referenced. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available data - the only reference is the Patchstack advisory for 2.0.3, which does not state a corrected release, so verify the current plugin version and any newer changelog directly with DevItems before assuming a fix is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites for any installation of DevItems HashBar Notification Bar through version 2.0.3 and deactivate or remove the plugin where it is not business-critical; if it must remain enabled, restrict access to the affected plugin parameter to trusted administrator accounts, rotate credentials for all WordPress administrators, enforce MFA, and deploy WAF SQL injection rules with logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today