EUVD-2026-57954
GHSA-6hwm-5426-rxg2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Subscriber credential required (PR:L); scope change to database layer confirmed (S:C); read-only injection with no data modification yields I:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
AnalysisAI
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
Technical ContextAI
CubeWP (CPE: cpe:2.3:a:imran_tauqeer:cubewp:*:*:*:*:*:*:*:*) is a WordPress framework plugin authored by Imran Tauqeer, designed to extend WordPress site-building capabilities. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause class: subscriber-controlled input is concatenated into or otherwise passed unsanitized into SQL query logic, allowing an attacker to reshape the database query. The CVSS scope indicator S:C signals that exploitation crosses the intended security boundary of the plugin component into the broader database layer, granting read access to tables the plugin was not designed to expose - including WordPress core tables containing user credential hashes, email addresses, site options, and any other data co-located in the database. The WordPress subscriber role is the lowest authenticated role and carries no elevated capabilities beyond reading published content; it is typically granted automatically upon user registration.
RemediationAI
The primary remediation is to update the CubeWP plugin to a version beyond 1.1.30; the exact patched release version is not confirmed in the available intelligence, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-30-sql-injection-vulnerability should be consulted before upgrading to confirm the fixed version. As an interim compensating control, disabling open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') eliminates the easiest path to obtaining a subscriber credential, though this prevents new user sign-ups as a trade-off. Deploying a WordPress-aware WAF with SQL injection signatures can reduce automated exploitation attempts but is not a reliable sole control given the authenticated context. If exploitation cannot be ruled out on an exposed instance, administrators should audit recent subscriber account activity and consider rotating the WordPress database credentials.
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP - All-in-One Dynamic Content Framework.1.
CubeWP - All-in-One Dynamic Content Framework plugin for WordPress versions up to 1.1.23 contains a privilege escalation
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Ac
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today