Quentn WP EUVD-2026-74715

Exploitation requires a valid WordPress administrator account on the target site and the Quentn WP plugin installed and active in a version prior to 1.2.15. The attacker must be able to authenticate to the WordPress admin interface (wp-admin). No special server configuration or non-default settings are required beyond the plugin being present. What limits exploitation: the PR:H requirement means this cannot be triggered by unauthenticated visitors or low-privilege subscribers/editors - only full administrators can reach the vulnerable code path. This substantially narrows the attack surface to insider threats, credential-compromise scenarios, or attackers who have already achieved admin access through other means.

Real-world risk is substantially lower than a raw scope-changed CVSS vector might suggest. Exploitation requires PR:H (full WordPress administrator credentials), meaning an attacker must already have achieved administrator-level access - a significant prerequisite that constrains the attack surface to insider threats, compromised admin accounts, or post-initial-access lateral movement within a WordPress environment. The CVSS score of 4.1 (Medium) reflects these constraints. EPSS at 0.16% (5th percentile) is consistent with this limited exploitability, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation campaigns. However, publicly available exploit code from WPScan means a motivated attacker with admin access could operationalize this with minimal effort. The confidentiality impact is limited (C:L - partial data read), with no integrity or availability impact per the provided vector. This is not a priority for most environments unless untrusted administrators are a concern.

An authenticated WordPress administrator navigates to a Quentn WP plugin settings or management page, submits a crafted request containing SQL metacharacters in a vulnerable parameter (e.g., a filter or ID field), and the unsanitized value is executed directly in an SQL query - allowing the attacker to enumerate the WordPress database, including user credentials, configuration values, and data from other installed plugins. A WPScan-published proof-of-concept demonstrates the injection point, reducing the technical skill bar for exploitation.