What is the CVSS score of EUVD-2026-38672?

EUVD-2026-38672 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of ClearSale Total are affected by EUVD-2026-38672?

The ClearSale Total WordPress plugin (all versions through 3.4.2) contains an unauthenticated SQL injection vulnerability allowing remote attackers to extract sensitive database contents without…

How to fix or mitigate EUVD-2026-38672?

Within 24 hours: Identify all WordPress installations running ClearSale Total plugin; disable the plugin immediately if non-critical, or apply database access restrictions. Within 7 days: Deploy WAF rules to block SQL payloads on the clearsale_total_push AJAX endpoint (/wp-admin/admin-ajax.php?action=clearsale_total_push); enable database activity monitoring and restrict database user privileges to least-access. Within 30 days: Identify replacement payment fraud solutions; configure automated monitoring of ClearSale vendor security advisories and establish upgrade timeline once patch is released.

ClearSale Total EUVD-2026-38672

| CVE-2026-8705 HIGH

SQL Injection (CWE-89)

2026-06-24 Wordfence

GHSA-58pf-7c32-vjf7

SQLi PHP WordPress Clearsale Total

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network unauthenticated, but AC:H because exploitation requires the target to run PHP < 8.0; impact limited to confidentiality via data exfiltration from UPDATE-based SQLi.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:52 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.5

DescriptionCVE.org

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the pagseguro[metodo] POST parameter of the clearsale_total_push AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (wp_ajax_nopriv_clearsale_total_push), and although a wp_verify_nonce() check exists, the failing branch's die() is commented out so execution continues regardless of nonce validity. On PHP < 8.0 the attacker-supplied $metodo value bypasses the switch ($metodo) { case 4: ... } guard via loose type juggling (the string "4 AND SLEEP(5)" compares equal to integer 4), reaching an unquoted UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ... query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the target server to be running PHP < 8.0.

Articles & Coverage 2

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026 News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Unauthenticated SQL injection in the ClearSale Total WordPress plugin (all versions through 3.4.2) allows remote attackers to extract sensitive database contents via the pagseguro[metodo] POST parameter of the clearsale_total_push AJAX action. The flaw is reachable without authentication because the nopriv AJAX handler ships with a commented-out die() in the nonce-failure branch, and on PHP < 8.0 loose type juggling bypasses the switch/case integer guard. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

ClearSale Total is a WordPress e-commerce anti-fraud plugin that integrates with Brazilian payment gateways such as PagSeguro. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) compounded by two upstream weaknesses: a broken authorization gate (the wp_verify_nonce() failure path lacks a die()/exit, so execution falls through) and reliance on PHP's loose-equality switch statement, where the string '4 AND SLEEP(5)' is coerced to integer 4 and matches case 4. The vulnerable sink is an unquoted UPDATE statement against wp_cs_total_dadosextras that interpolates the attacker-controlled $metodo value directly into the query, enabling stacked-condition injection (boolean/time-based) to exfiltrate data. PHP 8.0 introduced stricter string-to-int comparison semantics (RFC: Saner string to number comparisons), which is why the bug is gated to PHP < 8.0 runtimes.

RemediationAI

No vendor-released patch identified at time of analysis - version 3.4.2 (the latest as of this advisory) is still vulnerable, so site operators should deactivate and remove the ClearSale Total plugin until a fixed release is published by the vendor or replace it with an alternative anti-fraud integration. As a compensating control, upgrading the underlying PHP runtime to 8.0 or later neutralizes the type-juggling bypass that reaches the injection sink and is independently recommended (PHP 7.x is end-of-life); note this does not fix the missing die() after nonce failure and would still leave the broken authorization in place if future code paths reach it. Operators who cannot remove the plugin can block POST requests to /wp-admin/admin-ajax.php where action=clearsale_total_push at a WAF/reverse-proxy layer (Wordfence, Cloudflare WAF, ModSecurity), accepting the trade-off that any legitimate plugin functionality using this AJAX endpoint will break. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/871f6611-3b5e-4e36-992c-726b31e88c95 for fix availability.