tagDiv Opt-In Builder CVE-2026-96329

Exploitation requires the tagDiv Opt-In Builder (td-subscription) plugin version ≤1.7.6 installed and active on a WordPress site, plus a valid authenticated account at low privilege level (PR:L - e.g., subscriber or contributor), since the CVSS vector specifies PR:L rather than PR:N. No user interaction is needed (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement: an attacker must be able to register or obtain a low-privilege account, so sites that disable open registration substantially reduce exposure. Being blind SQLi, exploitation is slower (inference-based extraction) but still fully automatable.

This is a blind SQL injection (CWE-89) in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) affecting all versions through 1.7.6. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L) and no user interaction, with a scope change and high confidentiality impact - consistent with an authenticated (at least subscriber-level) user extracting database contents. Exploitation signals are thin: no EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is best characterized as 'no public exploit identified at time of analysis' rather than an active threat. The real-world priority is moderate: SQL injection in WordPress plugins is a frequently weaponized bug class and Patchstack-reported SQLi often gains POCs post-disclosure, but the PR:L requirement (the attacker needs a valid account) meaningfully limits mass, unauthenticated exploitation. Note a tension to verify: the input vector asserts S:C (scope changed), which is unusual for a plugin-level SQLi that typically stays within the WordPress database authorization scope - an independent assessment would likely rate S:U, which would lower the real base score. EPSS and KEV data are simply absent (not an error), so the absence of exploitation evidence should not be read as proof of low risk for a publicly disclosed SQLi.

An attacker who holds any low-privileged account (e.g., a registered subscriber) on a WordPress site running tagDiv Opt-In Builder ≤1.7.6 sends crafted input to a vulnerable plugin parameter that is concatenated into an SQL query. Because the injection is blind, the attacker infers results through boolean/time-based responses, iteratively extracting usernames, password hashes, and secret keys from the wp_users and wp_options tables. No public exploit code is identified at time of analysis, but the low attack complexity makes POC development straightforward once the vulnerable endpoint is known.