vitepos WordPress Plugin EUVD-2026-54993

Exploitation requires three concrete conditions: first, the vitepos WordPress plugin must be installed and active in a version prior to 3.6.0; second, the attacker must authenticate to WordPress with a valid administrator-level account (PR:H - subscriber, contributor, author, or editor roles are insufficient); third, the WordPress REST API must be reachable over the network, which is the default configuration. The attack is limited by the high privilege requirement, meaning unauthenticated remote attackers and lower-privilege WordPress users cannot exploit this directly. No specific non-default plugin configuration is required beyond having vitepos active - the vulnerable report endpoint is part of the plugin's default REST API surface. The scope change (S:C) implies the SQL injection can reach database resources outside WordPress's own tables, but this depends on the MySQL/MariaDB user permissions granted to the WordPress database account.

The CVSS base score of 4.1 accurately reflects the constrained threat model: the high privilege requirement (PR:H) and limited confidentiality impact (C:L) substantially reduce real-world risk compared to a typical unauthenticated SQL injection. The EPSS score of 0.16% at the 6th percentile corroborates this - mass exploitation is unlikely given the authentication gate. There is no CISA KEV listing, so confirmed active exploitation is absent at time of analysis. The publicly available WPScan POC lowers the technical effort for any attacker who already holds admin credentials, meaning that even a mid-sized municipal IT team in opole relying on vitepos should treat this as a patch-priority issue rather than a deferred low-risk item, since compromised WordPress admin accounts are a common post-breach pivot. The S:C scope change is the most meaningful risk amplifier: the attacker's SQL access is not strictly bounded by WordPress's own data, potentially reaching other database schemas on the shared MySQL/MariaDB instance. Overall, this is a legitimate but bounded risk - the CVSS score is appropriate, and the absence of KEV listing and low EPSS support a patch-not-emergency classification unless admin credential exposure is already a concern in the environment.

An attacker who has obtained WordPress administrator credentials - via credential stuffing against a reused password, a phishing campaign, or lateral movement from a previously compromised service - sends a crafted REST API POST request to the vitepos report endpoint, embedding a malicious SQL fragment in the identifier field of the JSON body. The plugin passes this value directly into the database query, allowing the attacker to enumerate tables, extract user records including hashed passwords, and potentially access data from other schemas on the same database server. A publicly available POC documented in the WPScan advisory demonstrates this injection technique.