BuildKit WordPress CVE-2026-94298

Exploitation requires an authenticated Contributor-level account on the target WordPress site and the ability to submit content through the BuildKit plugin's affected input, which is stored without proper sanitisation/escaping. The injected SQL only executes after the content is published and subsequently loaded during an unauthenticated visitor's page view (second-order/stored injection), so a publish-and-view step gates execution. Limiting factors: attacker must first hold a Contributor role (not available in default anonymous access), content may require no additional moderation but must be viewable, and only the BuildKit plugin before 1.0.29 is affected - sites on 1.0.29+ or without the plugin are not exposed.

This is a stored/second-order SQL injection (CWE-89) in the BuildKit WordPress plugin before 1.0.29. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N = 6.2 Medium) indicates a network-reachable, low-complexity flaw with confidentiality impact only and a scope change. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept was supplied - so this reflects no public exploit identified at time of analysis rather than active exploitation. A key signal conflict must be flagged: the CVSS vector states PR:H (high privileges), but the description explicitly says the injection is performed by a Contributor-level user, which is a LOW-privilege authenticated role in WordPress - the vector arguably overstates the required privilege and should be PR:L; verify with the WPScan advisory. Additionally, UI:R is recorded, consistent with the description's requirement that the malicious content be published and then viewed, triggering the query under a visitor's request. Overall this is a moderate, not top-tier, priority: exploitation requires an authenticated contributor account, impact is limited to confidentiality (data disclosure, no integrity/availability per the vector), and the affected product is a niche plugin, keeping real-world risk below what the 'SQLi' label alone might suggest.

An attacker who has obtained or been granted a Contributor account on a target WordPress site submits a post or content item containing a crafted SQL payload in a field the BuildKit plugin fails to sanitise. Once the content is published and an unauthenticated visitor views the page, the stored payload executes against the database, enabling disclosure of sensitive data. No public exploit code was provided, so exploitation presently requires custom payload crafting.