EUVD-2026-15594
GHSA-h32g-9c53-mwvr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
AnalysisAI
A blind SQL injection vulnerability exists in NooTheme's Organici Library WordPress plugin through version 2.1.2, allowing unauthenticated attackers to extract sensitive data from the underlying database without direct error feedback. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Commands) and has been documented by Patchstack as a critical WordPress plugin security issue. While no CVSS score, EPSS probability, or public proof-of-concept availability has been confirmed in available sources, the blind SQL injection attack vector and broad plugin distribution make this a medium-to-high priority for WordPress administrators managing affected installations.
Technical ContextAI
The Organici Library (affected via CPE cpe:2.3:a:nootheme:organici_library:*:*:*:*:*:*:*:*) is a WordPress plugin component developed by NooTheme that likely provides reusable UI or data-handling functions for theme and plugin ecosystems. The vulnerability stems from CWE-89, which describes the failure to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. In a blind SQL injection scenario, the attacker cannot observe direct error messages or query results but instead infers database structure and content through time-based delays, Boolean-based logic, or other side-channel techniques. This differs from error-based or union-based SQL injection, making exploitation more time-consuming but equally viable for extracting authentication credentials, user data, or sensitive configuration information stored in WordPress database tables.
RemediationAI
The primary remediation is to upgrade NooTheme Organici Library to a version newer than 2.1.2 as soon as a patched release is available; administrators should check the vendor's official repository or Patchstack for the patched version number and upgrade timeline. Until patching is complete, implement input validation and parameterized query enforcement at the application level if the plugin code is accessible for modification, and review WordPress security logs for anomalous SQL query patterns or time-delay attacks against the plugin's endpoints. Additionally, restrict direct database access to the WordPress application user account (apply principle of least privilege), enable WordPress security headers (Content-Security-Policy, X-Content-Type-Options), and consider deploying a Web Application Firewall (WAF) with SQL injection detection rules on the reverse proxy or CDN layer. Database activity monitoring and query rate-limiting can further reduce the window of successful blind SQL injection exploitation. Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/noo-organici-library/vulnerability/wordpress-organici-library-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve) for patch release announcements.
More in Organici Library
View allA PHP Object Injection vulnerability exists in NooTheme's Organici Library plugin through version 2.1.2, stemming from u
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme's Organici Library plugin for WordPress, affecti
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today