tagDiv Opt-In Builder CVE-2026-96330

The target WordPress site must have the tagDiv Opt-In Builder (td-subscription) plugin installed and active at a version at or below 1.7.6, with the subscription/opt-in functionality reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation needs no authentication and no user interaction, but note the PR:N claim is vendor-asserted; many Patchstack-reported plugin SQLi flaws in practice require at least a low-privilege authenticated account, so defenders should verify whether the vulnerable endpoint is truly pre-authentication. Because the injection is blind, exploitation requires iterative inference requests rather than a single data-returning query, which modestly slows (but does not prevent) bulk data extraction.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection requiring no user interaction, which drives the 9.3 'Critical' score, further inflated by the Scope-change flag (S:C). However, several key real-world signals are MISSING: no EPSS probability, no CISA KEV listing, and no POC/exploit-code indicator are present in the input, so active-exploitation or mass-scanning risk cannot be confirmed - there is no public exploit identified at time of analysis. The impact metrics are also internally notable: despite CWE-89 SQL injection (which typically enables database read), the vendor-assigned vector sets C:H/I:N/A:L, implying a blind, read-oriented data-disclosure flaw rather than full database takeover. One tension worth verifying with the vendor: Patchstack-sourced WordPress plugin SQLi often requires at least low-privilege (subscriber/author) authentication in practice, yet the vector asserts PR:N (unauthenticated) - the terse description does not independently confirm the no-auth claim, so treat PR:N as vendor-asserted, not corroborated. Net: a genuinely high-priority flaw for any site running this plugin because it is pre-auth and network-facing per CVSS, but the absence of EPSS/KEV/POC means it is not (yet) demonstrably under active exploitation.

A remote attacker sends a crafted request to the td-subscription opt-in/subscription endpoint exposed by the plugin, injecting SQL into a parameter that is not properly sanitized. Because the injection is blind, the attacker uses boolean- or time-based inference to extract WordPress database contents such as user records and password hashes. No public exploit code is identified in the provided data, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this requires only a single low-complexity network request with no user interaction.