What is the CVSS score of EUVD-2026-57870?

EUVD-2026-57870 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of If-So are affected by EUVD-2026-57870?

The If-So Dynamic Content Personalization WordPress plugin (versions 1.10 or earlier) contains a critical SQL injection vulnerability (CVSS 9.3) that could expose the entire WordPress database…

How to fix or mitigate EUVD-2026-57870?

Within 24 hours: identify all sites running If-So Dynamic Content Personalization plugin version 1.10 or earlier; immediately disable the plugin as a temporary measure; document current database contents and user access logs for incident forensics. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the vulnerable parameter if the plugin must remain active; rotate all WordPress administrator and database user credentials; enable audit logging on the WordPress database to monitor for unauthorized queries. Within 30 days: monitor for patch release from If-So; evaluate alternative personalization plugins without known vulnerabilities; if no patch is released, permanently remove the plugin and migrate personalization functionality to a hardened alternative or in-house solution.

If-So EUVD-2026-57870

| CVE-2026-66446 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-gwhm-mmjm-gvpr

WordPress SQLi Wordpress Plugin If So Dynamic Content Personalization

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Patchstack 'Subscriber' naming implies a low-privilege account so PR:L; network SQLi with low complexity yields high confidentiality and low availability impact, integrity unaffected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:37 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

AnalysisAI

SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.

Technical ContextAI

The affected component is If-So Dynamic Content Personalization, a WordPress plugin (CPE cpe:2.3:a:if-so_dynamic_content:if-so_dynamic_content_personalization) that renders different site content based on visitor conditions. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL query executed against the WordPress MySQL/MariaDB backend without parameterization or proper escaping via $wpdb->prepare(). Because WordPress stores authentication hashes, session tokens, and secret keys in the same database, a successful injection against wp_users/wp_options has broad impact.

RemediationAI

Upgrade the If-So plugin to the first release above 1.10 that Patchstack lists as patched; the exact fixed version is not present in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/if-so/vulnerability/wordpress-if-so-dynamic-content-personalization-plugin-1-10-sql-injection-vulnerability) or the plugin changelog before scheduling the update. Until patched, reduce exposure by disabling or deactivating the If-So plugin if the personalization feature is non-essential (side effect: dynamic/conditional content stops rendering), disabling open user registration or setting 'New User Default Role' below the level required to reach the vulnerable code (side effect: blocks legitimate self-service signups), and deploying a WAF virtual patch or Patchstack's own protection to filter SQLi patterns on the affected endpoint (side effect: possible false positives). Restrict administrative and plugin endpoints to trusted IPs where feasible.