EUVD-2026-81510
GHSA-gp6p-c2hf-v943
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as WordPress Administrator
-
DeliveryAccess PublishPress Series admin function
-
ExploitInject SQL via unsanitized parameter
-
ExecutionDatabase executes crafted query
-
ImpactRead sensitive DB rows / limited data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user with Administrator privileges (PR:H) on a site running PublishPress Series / Organize Series version 3.1.3 or earlier; the injection is reached through the plugin's admin-side functionality, so it is not exposed to unauthenticated visitors or lower-privileged roles. The primary limiting factor is the admin authentication gate: in standard WordPress an Administrator already holds broad database and site control, which sharply reduces the practical value of the injection. No user interaction beyond the attacker's own admin session is needed (UI:N). |
| Impact | This is a high-CVSS-number, low-real-priority issue. The vendor (Patchstack) CVSS:3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L yields 7.6, but the decisive metric is PR:H - exploitation requires an already-authenticated WordPress Administrator. In a default WordPress deployment an Administrator already possesses effectively full control of the site and, through plugin/theme editors and export tooling, near-total access to the underlying database; SQL injection therefore grants little incremental capability beyond what the role legitimately holds. The S:C (scope-changed) and C:H/I:N choices are debatable: a classic SQLi does not obviously cross a security authority boundary (arguing for S:U), and an injectable query that reads data typically also enables writes (I should not be N). No EPSS score, no CISA KEV listing, and no public exploit are provided in the input, so under any SSVC-style triage this rates low/track: not automatable at scale (admin auth gate), constrained technical impact, no evidence of exploitation. Bottom line: genuine bug worth patching, but not an emergency - treat as routine remediation, not incident-driven. |
| Exploit ScenarioDerived | An authenticated WordPress Administrator on a site running PublishPress Series (a.k.a. Organize Series) <= 3.1.3 submits a crafted value to a plugin admin parameter that is concatenated unsafely into a SQL query, causing the backend database to execute attacker-controlled SQL. No public exploit code is identified at time of analysis; realistic abuse is limited to a rogue or compromised admin account, or a second-order attack that first hijacks an admin session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
RemediationAI
No vendor-released patch version is identified in the available data, so the immediate action is to update PublishPress Series / Organize Series beyond 3.1.3 as soon as a fixed release is published, tracking the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/organize-series/vulnerability/wordpress-publishpress-series-plugin-3-1-3-sql-injection-vulnerability for the corrected version number; do not assume 3.1.4 is fixed until the advisory confirms it. If the plugin is not actively used, deactivating and deleting it removes the attack surface entirely at the cost of losing series functionality. Because exploitation requires Administrator privileges, the highest-value compensating control is credential hygiene: enforce unique strong passwords and MFA for every Administrator account (mitigates stolen-session and credential-stuffing paths but adds login friction), audit and prune unused admin accounts and roles, and rotate administrator credentials if compromise is suspected. A WAF or reverse-proxy rule restricting plugin admin endpoints to trusted sessions offers only partial protection since the attacker already holds a valid admin session and can reach those endpoints normally. As a containment measure, confirm the WordPress database user is scoped to the single application schema with no FILE, SUPER, or cross-schema grants, which caps what the injected query can reach but does not stop data exfiltration from the site's own tables.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PublishPress Series is a WordPress plugin (slug 'organize-series') that groups posts into recurring series and exposes management screens and AJAX handlers under the WordPress admin. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaching the plugin's admin-side query path is concatenated or interpolated into SQL without proper parameterization or $wpdb->prepare() usage, letting the caller alter the statement's logic. The affected component is tracked under CPE cpe:2.3:a:publishpress:publishpress_series:*:*:*:*:*:*:*:* and the entry is mirrored in the EUVD catalogue as EUVD-2026-81510, both pointing at versions up to and including 3.1.3. It is a classic authenticated-injection pattern in the WordPress ecosystem, where the privilege gate rather than the injection primitive is the limiting control; the CNA scored the change as scope-changing (S:C, 7.6), while the independent assessment treats it as S:U with C:H/I:L/A:L, so the injection is best characterized as a high-confidentiality database read with limited write and availability effect rather than full site takeover.
Know when Publishpress Series gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Remote but admin-only, so AV:N/AC:L/PR:H; SQLi within the same DB is no scope change (S:U); read impact high, write/availability partial (I:L/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
Executive ViewAI
PublishPress Series (also distributed as Organize Series) versions 3.1.3 and earlier contain a SQL injection weakness in its WordPress administrative interface that lets a logged-in site Administrator execute arbitrary database queries against the WordPress database. Only accounts that already hold full Administrator privileges can trigger it, so the practical incremental risk to most organizations is limited, though any site running the affected plugin on a shared or outsourced administrative model should still treat it as an exposure. Leadership should care primarily because it underscores how third-party plugins inherit and can widen the trust already granted to privileged WordPress users, and because no vendor fix is yet available to close the gap.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall PublishPress Series / Organize Series where it is not operationally required; restrict and regularly recertify WordPress Administrator accounts using least privilege and enforce multi-factor authentication on all remaining admin accounts; deploy a virtual patching or web application firewall rule filtering malformed input to the plugin's administrative endpoints; enable and monitor administrative audit logging for unexpected database access patterns; and restrict administrative interface access by IP allowlisting or network placement where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Publishpress Series
View allStored cross-site scripting in the PublishPress Series WordPress plugin affects all versions through 3.1.3, allowing an
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting ve
Cross-site request forgery in PublishPress Series (versions up to and including 3.1.3) allows an unauthenticated attacke
Exploit-DB