EUVD-2026-65459
GHSA-cx86-qpq6-9vr9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator authentication required (PR:H); SQL injection yields database read-only access with no integrity or availability impact (I:N, A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Media Sweep - WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an authenticated WordPress session with administrator-level privileges (or higher, such as super-admin on multisite). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS base score of 4.9 accurately reflects the constrained real-world risk profile of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A WordPress administrator - either a malicious insider or an attacker who has already obtained admin credentials through phishing or credential stuffing - sends a crafted HTTP request to the plugin's REST API scan endpoint, supplying a manipulated 'fields' parameter containing additional SQL clauses. The injected SQL executes in the database context of the WordPress installation, allowing the attacker to exfiltrate contents of wp_users, option tables, or other sensitive database tables. … |
| Remediation | Update the Media Sweep - WordPress Media Cleaner plugin to a version beyond 1.1.3 once a patched release is available in the WordPress plugin repository; the upstream fix is captured in changeset 3663766 on the WordPress SVN. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today