What is the CVSS score of EUVD-2026-31044?

EUVD-2026-31044 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Boost Plugin are affected by EUVD-2026-31044?

The PixelYourSite Boost WordPress plugin (versions through 2.0.3) contains an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive database contents without valid…

How to fix or mitigate EUVD-2026-31044?

Within 24 hours: disable or uninstall PixelYourSite Boost plugin on all WordPress instances and review database access logs for suspicious queries in the last 30 days. Within 7 days: confirm plugin removal across all systems and subscribe to vendor security advisories for patch updates. Within 30 days: implement Web Application Firewall rules to block SQL injection patterns and establish a formal plugin security assessment process.

Boost Plugin EUVD-2026-31044

| CVE-2026-9010 HIGH

SQL Injection (CWE-89)

2026-05-20 Wordfence

GHSA-xxj3-cp34-3h25

WordPress SQLi Pixelyoursite Boost

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:03 vuln.today

DescriptionCVE.org

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in the PixelYourSite Boost plugin for WordPress (versions up to and including 2.0.3) allows remote attackers to extract sensitive database contents via time-based blind SQLi in the 'current_url' and 'user_name' parameters. Wordfence reported the issue with a CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue rooted in WordPress plugin database access patterns. The Boost plugin (CPE cpe:2.3:a:pixelyoursite:boost) concatenates user-supplied 'current_url' and 'user_name' parameters into SQL statements without using $wpdb->prepare() placeholders or wpdb::esc_like()/esc_sql() sanitization. Because the injection is time-based blind, exploitation relies on conditional SLEEP()/BENCHMARK()-style payloads to infer data one bit at a time from the underlying MySQL/MariaDB backend that WordPress relies on.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; site operators should monitor https://www.pixelyoursite.com/boost-plugin and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1cac2397-bb38-40d6-b90d-68e3ea136267?source=cve for a release beyond 2.0.3 and upgrade immediately when available. In the interim, deactivate and remove the Boost plugin if it is not business-critical (side effect: loss of plugin functionality such as conversion tracking/pixel features), or place the WordPress site behind a WAF such as Wordfence/Cloudflare with rules blocking SQL metacharacters and time-function payloads (UNION, SLEEP, BENCHMARK) in the 'current_url' and 'user_name' request parameters (side effect: potential false positives on legitimate URLs containing reserved characters). As a defense-in-depth measure, restrict the database user used by WordPress to least-privilege SELECT on its own schema to limit the blast radius of any successful extraction.