WP Business Intelligence EUVD-2026-42802

Exploitation requires (1) an authenticated WordPress account of at least Subscriber level on the target site - obtainable for free where open registration is enabled - and (2) administrator interaction, because the injected SQL only executes when an administrator opens/views the tampered stored query in the WP Business Intelligence Lite reporting interface (UI:R). What limits exploitation: the payload does not fire on its own and cannot be triggered by the attacker directly (it depends on an admin viewing the report), and on sites with self-registration disabled the attacker must already hold a valid low-privilege credential. The condition is specifically the plugin's stored-query modification action lacking an authorization/capability check (CWE-862) in Admin/Menu/Query.php.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) frames this as network-reachable and low-complexity but gated by two real limiters: it requires an authenticated account (PR:L) and administrator interaction (UI:R) to trigger the payload, so it is not a fully unauthenticated drive-by. No EPSS score was supplied in the input, the CVE is not in CISA KEV, and no proof-of-concept or public exploit was provided, so all three exploitation-intensity signals point to no confirmed in-the-wild activity. The practical risk is nonetheless meaningful on sites that allow open user registration (default Subscriber role), because the barrier to obtaining a Subscriber account is trivial and the impact on trigger is full database read/write in the admin context. On sites that disable self-registration, the attacker must already possess a low-privilege account, which substantially narrows the realistic threat. Net: a genuine high-severity privilege-escalation issue where the SSVC-style exploitation status is 'none observed' and automatability is limited by the admin-view requirement, so it is a prompt-patch item rather than an emergency for registration-closed deployments.

An attacker registers a low-privilege Subscriber account (or uses an existing one) on a WordPress site running WP Business Intelligence Lite 3.2.0 or earlier, then sends the unauthorized query-modification request to inject a malicious SQL statement into a stored report. When an administrator subsequently opens that report in wp-admin, the attacker's SQL runs with the database access of the plugin, allowing the attacker to escalate privileges - for example by promoting their account to administrator or altering credentials. No public proof-of-concept was provided, but the low attack complexity means weaponization would be straightforward for an attacker with a valid low-privilege login.