EUVD-2026-81506
GHSA-qq9c-36g8-f2xx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as WordPress admin
-
ExploitSubmit crafted input to vulnerable endpoint
-
ExecutionInjected SQL executes against database
-
ImpactExfiltrate arbitrary database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress Administrator session (PR:H) on a site running WPMasterToolKit version 2.22.0 or earlier; the attacker submits malicious input to the affected plugin functionality to inject SQL. No user interaction beyond the attacker's own admin action is needed (UI:N), but the Administrator privilege prerequisite is the dominant limiting factor - the vulnerable role already holds broad legitimate database access in WordPress, sharply reducing real-world exploitation value to insider or post-compromise scenarios. |
| Impact | This is a high-CVSS-but-low-real-priority finding. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) is driven up by the Scope:Changed and Confidentiality:High metrics, but the decisive limiter is PR:H: exploitation requires an authenticated WordPress Administrator, per both the vector and the vulnerability title 'Administrator SQL Injection.' In WordPress a site Administrator already possesses near-total control over the database and application through legitimate dashboard functionality, so an admin-only SQL injection crosses almost no real privilege boundary and is of marginal value to a realistic attacker. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data, so this is 'no public exploit identified at time of analysis.' The S:C claim is questionable for an in-application SQLi that does not clearly escape to a separate security authority - this inflates the score. Net: not an operational priority; it is a hardening/defense-in-depth fix rather than an urgent patch. |
| Exploit ScenarioDerived | A malicious or compromised WordPress Administrator account submits crafted input to a vulnerable WPMasterToolKit endpoint (≤2.22.0), injecting SQL that reads arbitrary database contents such as other users' password hashes or secrets. No public exploit code is identified in the provided data, and the attack requires an already-authenticated admin session, so the practical risk is confined to insider abuse or a post-compromise privilege-to-data pivot. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
SQL injection in the WordPress plugin WPMasterToolKit affects versions 2.22.0 and earlier, allowing an attacker who already holds a WordPress Administrator session to inject arbitrary SQL through affected plugin functionality and read data from the underlying database. Exploitation requires the highest standard WordPress privilege level (PR:H per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and the assessed impact is confidentiality-only - no integrity or availability effect was confirmed - while the vulnerability has no public exploit identified at time of analysis and is not listed as confirmed actively exploited (CISA KEV). Because the required Administrator role already has broad legitimate database and site access in WordPress, this is best characterized as a high-CVSS-but-low-real-priority finding whose practical value is largely limited to insider abuse or post-compromise escalation, with no vendor-released fixed version identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the available input data, so the immediate action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpmastertoolkit/vulnerability/wordpress-wpmastertoolkit-plugin-2-22-0-sql-injection-vulnerability) and the plugin's WordPress.org page for a release above 2.22.0, then upgrade to that version as soon as it is published; until then, treat 2.22.0 and earlier as vulnerable. As a strong compensating control, deactivate and remove WPMasterToolKit on sites that do not require it, which eliminates the vulnerable code path entirely (trade-off: loss of the plugin's admin tooling). Because exploitation requires an Administrator session, reduce the attack surface by auditing and minimizing the number of Administrator accounts, enforcing least privilege so only trusted operators hold that role, removing dormant or orphaned admin users, and enforcing strong authentication (unique passwords plus multi-factor) on all admin accounts - these measures shrink the insider and post-compromise paths this bug depends on but do not remove the flaw itself. If a web application firewall is in place, add rules that constrain requests to the plugin's admin endpoints and reject SQL metacharacters in their parameters, accepting that such rules are bypassable and may generate false positives on legitimate admin traffic, and audit database and admin activity logs for anomalous query patterns or unexpected administrator actions while no fixed release is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPMasterToolKit is a third-party WordPress plugin (CPE cpe:2.3:a:ludwig_you:wpmastertoolkit:*:*:*:*:*:*:*:*), and the flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning attacker-supplied input reaches a database query without adequate parameterization or escaping. The issue sits inside plugin-provided administrative functionality, so the attack surface is the WordPress admin interface rather than the public-facing site, and the assessed vector confirms network reachability (AV:N) with low attack complexity (AC:L) but a high privilege prerequisite (PR:H) and no user interaction (UI:N). Scope is assessed as unchanged (S:U), and the resulting impact is high confidentiality loss with no confirmed integrity or availability impact, which is consistent with a read-oriented SQL injection against data the plugin can already access. Reported by Patchstack and tracked in the EU as EUVD-2026-81506.
Know when Wpmastertoolkit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Admin-only SQLi so PR:H; in-app injection does not cross to a separate authority so S:U (not S:C); read-oriented injection yields C:H, I:N/A:N per description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
Executive ViewAI
The WordPress plugin WPMasterToolKit, deployed at versions 2.22.0 and earlier, contains a SQL injection flaw that could allow someone already holding a WordPress Administrator session to read data directly from the site's database. Because the required Administrator role already carries broad legitimate access to site data and configuration, the practical risk is concentrated in insider misuse or post-compromise escalation rather than opportunistic external attack, and no vendor fix is currently available. Leadership should treat this as a governance and privileged-access issue affecting site owners and administrators rather than an urgent internet-facing emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and audit WordPress Administrator assignments, enforce multi-factor authentication and least privilege for administrative accounts, remove or disable WPMasterToolKit 2.22.0 and earlier where it is not operationally required, and monitor database query and administrative activity for anomalous data access indicating insider abuse or post-compromise escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB