What is the CVSS score of EUVD-2026-14017?

EUVD-2026-14017 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14017?

A SQL injection vulnerability in the myLinksDump WordPress plugin allows administrators with malicious intent or compromised admin accounts to extract sensitive database information.. A patch is available.

How to fix or mitigate EUVD-2026-14017?

Within 24 hours: Audit all administrator account activity and access logs for the myLinksDump plugin; identify all WordPress instances using this plugin. Within 7 days: Disable the myLinksDump plugin on all affected installations if business-critical functionality permits, or restrict admin access to only trusted personnel with mandatory MFA enforcement. Within 30 days: Evaluate alternative plugins with equivalent functionality and active security maintenance; plan migration away from myLinksDump pending vendor patch availability or consider custom development of required features.

WordPress EUVD-2026-14017

| CVE-2026-2279 HIGH

SQL Injection (CWE-89)

2026-03-21 Wordfence

GHSA-f468-x76g-m76r

GHSA-r9hf-rxjm-gv2f

WordPress SQLi

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14017

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 7.2

DescriptionCVE.org

The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The myLinksDump plugin for WordPress contains a SQL injection vulnerability in the 'sort_by' and 'sort_order' parameters affecting all versions up to and including 1.6. Authenticated attackers with administrator-level access can exploit insufficient input escaping and inadequate SQL query preparation to append malicious SQL queries and extract sensitive database information. While requiring high privileges (PR:H), the vulnerability has a CVSS score of 7.2 with high impact to confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the myLinksDump plugin (CPE: cpe:2.3:a:silvercover:mylinksdump:*:*:*:*:*:*:*:*), a WordPress plugin for managing and displaying links. The root cause is CWE-89 (SQL Injection), where user-supplied input from the 'sort_by' and 'sort_order' parameters is not properly escaped or sanitized before being incorporated into SQL queries. The vulnerable code is located in myLinksDump.php at lines 414 and 423, where these parameters are directly used in SQL construction without prepared statements or parameterized queries. This classic SQL injection flaw allows attackers to break out of the intended query context and inject arbitrary SQL commands that will be executed by the WordPress database layer.

RemediationAI

WordPress administrators should immediately update the myLinksDump plugin to a version newer than 1.6 if a patched version becomes available, or consider removing the plugin entirely if it is no longer maintained or unnecessary. Check the WordPress plugin repository and vendor communications for security updates addressing CVE-2026-2279. As an interim mitigation, restrict administrator account access through strong authentication policies including multi-factor authentication, regularly audit administrator account activity, and implement database activity monitoring to detect SQL injection attempts. Review administrator access logs and limit the number of accounts with administrator privileges following the principle of least privilege. Consider using WordPress security plugins that can detect and block SQL injection attempts even from authenticated users.