What is the CVSS score of EUVD-2026-62376?

EUVD-2026-62376 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Community by PeepSo are affected by EUVD-2026-62376?

Community by PeepSo (versions 9.0.5.2 and earlier) contains a SQL injection vulnerability allowing any registered subscriber to extract sensitive database contents without additional exploitation…

How to fix or mitigate EUVD-2026-62376?

Within 24 hours, audit all WordPress installations running Community by PeepSo version 9.0.5.2 or earlier, document subscriber user counts on affected sites, and immediately enforce database-level role restrictions preventing subscriber-level accounts from executing queries beyond basic read operations on non-sensitive tables. Within 7 days, either disable the Community by PeepSo plugin entirely, pause all new subscriber registrations and approvals, or migrate to an alternative community platform demonstrably free of this vulnerability class. Within 30 days, conduct forensic analysis of database access logs and query history from the prior 90 days to identify evidence of unauthorized access, implement continuous monitoring and alerting for anomalous query patterns originating from subscriber-level accounts, and prepare a user notification plan in case exploitation is confirmed.

Community by PeepSo EUVD-2026-62376

| CVE-2026-66668 HIGH

SQL Injection (CWE-89)

2026-08-19 Patchstack

GHSA-xc3j-r3w9-578m

WordPress SQLi Peepso Wordpress Plugin Community By Peepso

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Subscriber-level auth (PR:L) sufficient over network (AV:N) with no complexity; scope change reflects SQLi reaching WordPress core tables beyond plugin schema; I:N as write impact is not established.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:29 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

AnalysisAI

SQL injection in Community by PeepSo versions up to and including 9.0.5.2 is reachable by any subscriber-level authenticated user, enabling network-based extraction of sensitive database contents with a changed scope. Classified under CWE-89, the flaw requires only low-privilege WordPress credentials and no user interaction, lowering the exploitation barrier to any registered site member. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid WordPress subscriber-level account on the target site - the lowest default WordPress role, obtainable via open self-registration if that feature is enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.5 rating with AV:N/AC:L/PR:L/UI:N/S:C/C:H accurately models the threat: any authenticated subscriber can exploit this remotely with no complexity, and the high confidentiality impact extends across a changed scope to broader database contents. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Community by PeepSo to a version above 9.0.5.2 as the primary remediation; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/peepso-core/vulnerability/wordpress-community-by-peepso-plugin-9-0-5-2-sql-injection-vulnerability should be monitored for the confirmed fixed release version, which is not independently confirmed in the current intelligence data - do not infer a version number from this report. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all WordPress installations running Community by PeepSo version 9.0.5.2 or earlier, document subscriber user counts on affected sites, and immediately enforce database-level role restrictions preventing subscriber-level accounts from executing queries beyond basic read operations on non-sensitive tables. …

Threat intelligence, references, and detailed analysis are available after sign-in.