HashBar Notification Bar CVE-2026-94117

Requires an authenticated WordPress session with high privileges (PR:H - an administrator or equivalent role able to reach the affected HashBar parameter) on a site running HashBar - WordPress Notification Bar version 2.0.3 or earlier. No user interaction is needed (UI:N) and the injection point is network-reachable, but exploitation is limited by the high-privilege authentication requirement and by the blind (inference-based) nature of the injection, which makes data extraction slow. Impact escalates to a separate system (S:C) only where the plugin's SQL executes against a database shared with other applications or holding secrets beyond the WordPress install.

The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6) is the only quantitative signal available - there is no EPSS score, no CISA KEV listing, no SSVC decision data, and no public exploit code referenced. The single most risk-limiting metric is PR:H: the blind SQL injection requires an already-authenticated high-privilege account (effectively an administrator or equivalent role that can reach the vulnerable plugin parameter), which sharply narrows the realistic threat to insider misuse, compromised-credential scenarios, or a chained privilege escalation. Given PR:H, the practical value of a raw SQLi here is modest - an admin can already read much of the site - so C:H mainly matters where the database holds secrets beyond WordPress (e.g., shared/multi-tenant DBs), which is why S:C (scope-changed to the database engine) is defensible. This is a genuine but NOT top-priority issue: high CVSS number driven by S:C/C:H, but the PR:H gate and absence of any exploitation evidence make it a patch-in-normal-cycle item rather than an emergency. Missing data explicitly noted: no EPSS, no KEV, no POC, and the exact vulnerable endpoint/parameter is not disclosed in the description (blind SQLi implies time/boolean-based inference).

An authenticated high-privilege WordPress user (or an attacker who has captured such credentials) submits a crafted value to a HashBar plugin parameter that is concatenated into a SQL statement without neutralization, then uses boolean/time-based blind inference to extract database contents. No public proof-of-concept is referenced, and exploitation is bounded by the required high-privilege access and the slow, inference-based nature of blind SQLi.