EUVD-2026-82669
GHSA-52cc-m98v-q64v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine, actionable issue but likely lower real-world priority than the 8.6 vendor CVSS suggests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, and CWE-89 SQL injection reachable via an unauthenticated (wp_ajax_nopriv) AJAX action is a legitimately dangerous class. A public POC/writeup exists (WPScan), raising exploitability. However, several signals moderate the risk: there is no EPSS score, no CISA KEV listing (no confirmed active exploitation), and no known patched version, so exploitation is at present publicly-documented-but-not-confirmed-in-the-wild. Notably, the vendor vector asserts S:C (scope change) with C:H/I:N/A:N; for an in-database SQL-injection that extracts data, scope is normally S:U, so the 8.6 appears inflated - a more defensible score is ~7.5 (S:U/C:H). Impact is confidentiality-only (I:N/A:N), i.e., data extraction, not RCE or defacement. Net: real and worth patching for affected sites, but the tiny deployment footprint of this niche plugin makes it a targeted rather than widespread threat. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis, so the primary action is to deactivate and delete the 'wp shortcut link and advertisement baner' plugin from any WordPress installation where it is present; because the CPE shows no vendor and 1.2.0 is the terminal release, assume the plugin is abandoned and that no update will arrive, with the trade-off that deleting it removes whatever banner/shortcut-link functionality it provided. If removal is not immediately possible, the plugin exposes functionality through WordPress's AJAX dispatcher (admin-ajax.php) with a nopriv handler, so a virtual patch - a WAF/reverse-proxy rule that inspects requests to admin-ajax.php and blocks the specific plugin action when its parameter contains SQL metacharacters (quotes, comment sequences, UNION/SELECT keywords) - can blunt automated exploitation; the trade-off is potential false positives against legitimate plugin traffic and the need to identify the exact action name from the plugin source. Blocking admin-ajax.php for unauthenticated users entirely is not viable because many other plugins depend on nopriv AJAX, and restricting the endpoint by IP would break normal visitor functionality. Given the confidentiality-only, database-read impact, also treat any site where the plugin was active as potentially compromised: rotate WordPress admin credentials and database passwords, invalidate session tokens, and review web server and database logs for SELECT-style injection patterns or anomalous admin-ajax requests. Reference material is limited to the WPScan advisory and the NVD/EUVD record, so continuous monitoring of WPScan for any future fixed release is advised while the mitigation above is in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that registers a handler via the WordPress AJAX API (wp_ajax_nopriv_* in admin-ajax.php), meaning the callback is reachable by any anonymous visitor. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a request parameter is taken directly from user input and concatenated into a SQL statement without sanitization, escaping, or use of the WordPress $wpdb->prepare() parameterized-query API. Because the parameter is neither validated nor escaped, an attacker can terminate the intended statement and append arbitrary SQL, turning the endpoint into a classic unauthenticated injection point. The CVSS scope-change flag (S:C) reflects that the vulnerable plugin, acting within the web application, can read data owned by the surrounding database component (C:H with I:N/A:N), i.e. exfiltration of WordPress tables such as wp_users password hashes and wp_options secrets without modifying or deleting them. WPScan is credited as the reporting source, and the CPE cpe:2.3:a:unknown:wp_shortcut_link_and_advertisement_baner:*:*:*:*:*:*:*:* reflects that the plugin has no vendor entry in the CPE dictionary and all versions are treated as affected; EUVD records the range as '0 <= 1.2.0', so 1.2.0 is the last vulnerable release.
Know when Wp Shortcut Link And Advertisement Baner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Technical POC Analysis
Evidence base: WPScan advisory 1d103d80-1904-4aae-87b1-06a429ca85c9 only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) contains an unauthenticated SQL injection that can expose the underlying site database, and publicly available exploit code exists. No vendor-released patch identified at time of analysis, so internet-facing WordPress sites running this plugin face potential confidentiality loss. Leadership should prioritize discovery and removal where the plugin is installed, because exposed database contents may include user credentials or personal data, while recognizing that no CISA KEV listing confirms active exploitation and the plugin's low adoption may narrow real-world exposure.
No vendor patch; deactivate and remove the plugin, apply WAF virtual patching to block SQL injection against the AJAX action, restrict the vulnerable AJAX endpoint to authenticated users if operationally feasible, and monitor database and web logs for exfiltration attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB