What is the CVSS score of EUVD-2026-59896?

EUVD-2026-59896 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

User Login History EUVD-2026-59896

| CVE-2026-2283 MEDIUM

SQL Injection (CWE-89)

2026-08-16 Wordfence

GHSA-p789-q8m9-8xjm

WordPress SQLi Wordpress Plugin User Login History

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin credentials required (PR:H); injection is read-only so I:N/A:N; network-reachable web interface justifies AV:N/AC:L.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:18 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 4.9

DescriptionCVE.org

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on multisite installations.

AnalysisAI

SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.

Technical ContextAI

The flaw resides in the network admin login list table class (inc/admin/class-network-admin-login-list-table.php, lines 70 and 116), part of the User Login History plugin authored by faiyazalam (CPE: cpe:2.3:a:faiyazalam:user_login_history:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input for the 'blog_id' parameter is neither properly escaped nor parameterized via prepared statements before being interpolated into an existing SQL query. This classic second-order or inline injection pattern allows an attacker to append UNION-based or stacked SQL clauses. Because the code path is within the network admin interface, it is only reachable in WordPress multisite configurations where the Network Admin dashboard is active.

RemediationAI

Update the User Login History plugin to the version released after changeset 3484407, which contains the upstream code fix addressing the unsanitized 'blog_id' parameter in class-network-admin-login-list-table.php. Confirm the exact patched version via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4552786b-3362-45bf-9012-cd52f69f0462, as no explicit fixed release number was confirmed in available intelligence data. If immediate patching is not feasible on multisite installations, restrict Network Admin access to a minimal, fully trusted administrator set, as the vulnerability requires Administrator-level credentials - reducing the number of principals holding that role limits blast radius. Additionally, a Web Application Firewall rule targeting SQL metacharacter patterns in the 'blog_id' parameter can serve as a compensating control, though this may interfere with legitimate multisite blog ID values if not carefully tuned.