PixelYourSite Boost EUVD-2026-65162

Exploitation requires only that the PixelYourSite Boost plugin (version ≤2.0.4) is installed and activated on an internet-reachable WordPress site, with the vulnerable request-handling endpoint accessible - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, so no special configuration is described as necessary. The primary limiting factor is deployment scope: only sites with this specific plugin active are exploitable, which materially narrows the attack surface versus a WordPress-core flaw. The exact vulnerable parameter/endpoint and whether the injection is blind (consistent with the supplied I:N/C:H vector) should be confirmed from the Patchstack advisory.

The signals are mixed. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, 9.3 critical) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and a scope change - consistent with database exfiltration from an unauthenticated endpoint. However, no EPSS score, SSVC decision, POC, or KEV status was provided, so exploitation likelihood cannot be quantified from the input. It is NOT in CISA KEV and no public exploit was identified, arguing against confirmed active exploitation. The I:N (no integrity impact) in the supplied vector is atypical for SQLi and suggests the researcher assessed a read-only/blind injection rather than a data-modifying one - this should be verified against the Patchstack advisory. Given unauthenticated network reach and low complexity against WordPress (a heavily scanned surface), this warrants prompt patching where deployed, tempered by the plugin's narrow install base.

An attacker fingerprints a WordPress site running the Boost plugin ≤2.0.4, then sends a single crafted unauthenticated HTTP request with a malicious SQL payload in a request parameter. Because no authentication or user interaction is required and complexity is low, the attacker uses union-based or blind techniques to extract sensitive data such as user records, password hashes, and secret keys. No public exploit code was identified at time of analysis, but the low-complexity unauthenticated nature makes weaponization straightforward.