Green Popups CVE-2026-94388

Requires a running instance of the halfdata Green Popups plugin at a version before 7.6.3 on a WordPress site, with the vulnerable (unspecified) request parameter reachable over HTTP. The description does not name the specific endpoint, parameter, or any required feature toggle, and does not state an authentication prerequisite; the scored vector is PR:N (no privileges), but because Patchstack-tracked plugin SQLi often requires at least low-privileged (e.g., subscriber) authentication, the true privilege requirement is not confirmed from available data and limits certainty about pre-auth exploitability. The primary limiting factor is simply having a vulnerable version installed and active; being blind injection, exploitation requires inference-based extraction rather than direct output, which slows but does not prevent data theft.

This is a CWE-89 blind SQL injection in the Green Popups WordPress plugin, carrying a vendor (Patchstack) CVSS of 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - network-reachable, low complexity, no privileges, no user interaction, with a scope change and high confidentiality impact. On the CVSS signal alone this looks like a top-priority remote unauthenticated flaw. However, the corroborating real-world signals are largely ABSENT: no EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so no public exploit is identified at time of analysis. The single reference is the Patchstack database advisory, which is the originating source rather than independent corroboration. One notable tension: Patchstack-published WordPress plugin SQLi vulnerabilities frequently require at least low-privileged authentication (e.g., subscriber/contributor) even when their scored vector shows PR:N, so the PR:N / unauthenticated classification should be verified against the plugin code or advisory detail before treating this as fully pre-auth. Net assessment: a genuinely high-severity, easily weaponizable injection class in a moderately deployed plugin, but currently without evidence of active or widespread exploitation - patch promptly, treat as important but not confirmed-emergency pending exploitation data.

A remote attacker sends a crafted HTTP request to a vulnerable Green Popups endpoint containing a malicious SQL payload in an unsanitized parameter, triggering a blind SQL injection against the WordPress database. Because the injection is blind, the attacker uses boolean/time-based inference to extract data such as user password hashes and secret keys from wp_users and wp_options. No public POC is referenced, but blind SQLi in WordPress plugins is routinely automated with tools like sqlmap once the vulnerable parameter is known.