EUVD-2026-65356
GHSA-p7qj-6prj-qvr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Readabler below 2.0.18
-
ExploitSend crafted HTTP request with injected SQL payload
-
ExecutionInject clause appended to existing DB query
-
ImpactExtract sensitive records from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the presence of the Readabler plugin at a version below 2.0.18 on a network-accessible WordPress installation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default plugin configurations with no user interaction needed. Exploitation is bounded by: (1) the targeted site must have Readabler installed and active; (2) the specific parameter containing the injection point must be reachable - if the plugin's functionality is confined to authenticated pages or admin-only endpoints, the effective attack surface narrows, but this is not indicated by the available data. No non-default configuration, specific platform version, or special network position is required. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N places this at peak exploitability for a read-only injection: fully remote, unauthenticated, no user interaction, no special conditions, with high confidentiality impact. The absence of integrity and availability impact (I:N/A:N) suggests the injectable endpoint is constrained to SELECT-class operations rather than write access, though chained attacks using extracted credentials are plausible. No EPSS data was included in the source intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no confirmed proof-of-concept in the provided references, so no public exploit has been identified at time of analysis. Despite these absent escalation signals, the attack profile is trivially automatable - requiring only a WordPress site with the plugin active and network reachability - and should be treated as a near-term patching priority rather than a deferred risk. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running a vulnerable version of Readabler, injecting SQL syntax into an insufficiently sanitized parameter. The injected payload appends a UNION SELECT or stacked query clause, causing the database to return sensitive records such as WordPress user password hashes, email addresses, or stored plugin data. No account, session token, or prior reconnaissance is required beyond identifying sites running the plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
SQL Injection in the Readabler WordPress plugin affects all versions prior to 2.0.18, allowing unauthenticated remote attackers to append malicious SQL clauses to existing database queries and exfiltrate sensitive data from the WordPress database. The flaw stems from insufficient escaping of user-supplied input combined with unprepared SQL queries inside the plugin. No active exploitation is confirmed at time of analysis, but the zero-authentication, low-complexity, network-accessible attack path makes this a practical target for automated mass scanning campaigns.
RemediationAI
Upgrade the Readabler WordPress plugin to version 2.0.18 or later, which is identified as the first non-vulnerable version per the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/baaa9688-dfdc-4ab2-b033-fe2b13a42e77) and the Patchstack report (https://patchstack.com/database/wordpress/plugin/readabler/vulnerability/wordpress-readabler-plugin-2-0-18-sql-injection-vulnerability). If immediate upgrade is not feasible, disabling the Readabler plugin entirely removes the attack surface at the cost of its accessibility features. WordPress WAF rules from Wordfence or similar tools that detect common SQLi patterns can provide a partial compensating control, but should not substitute for patching as WAF signatures can be bypassed with encoding variations. Site administrators should also audit WordPress user accounts and API keys for signs of prior unauthorized access if the plugin was exposed on a public-facing site.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Readabler plugin for WordPress (CPE: cpe:2.3:a:readabler:readabler, all versions prior to 2.0.18) is an accessibility-enhancement plugin. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WordPress plugins interact with the database through the wpdb abstraction layer, which provides $wpdb->prepare() for parameterized queries and escaping helpers such as esc_sql(). This plugin fails to apply either mechanism to at least one user-controlled parameter, allowing attackers to inject additional SQL syntax that piggybacks on a legitimately structured query - enabling exfiltration of database contents including WordPress user credentials, configuration data, and plugin-stored records.
Know when Readabler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-accessible SQL injection yielding database read-only exfiltration; description and CVSS I:N/A:N confirm no write or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
The Readabler WordPress plugin (versions prior to 2.0.18) contains a SQL injection vulnerability allowing unauthenticated attackers to extract sensitive data from WordPress databases. Any organization running this plugin faces immediate risk of database compromise and potential exposure of customer information and application credentials. No vendor patch is available, requiring urgent remediation through plugin removal or compensating controls.
Disable the Readabler plugin immediately if not critical to operations. Deploy Web Application Firewall rules to detect and block SQL injection patterns. Apply database access controls with least-privilege principles, restricting the WordPress database user to only necessary tables and columns. Enable database query logging and alerting for suspicious access patterns or unusual data extraction. Implement network segmentation restricting database access to WordPress application servers only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB