Ultimeter EUVD-2026-85502

Exploitation requires an authenticated high-privileged WordPress account (PR:H - consistent with the 'Editor' context in the title, i.e. Editor/Administrator-level access) that can reach the vulnerable Ultimeter editor functionality; the affected plugin versions are Ultimeter <= 3.0.8. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factor is the privilege requirement: an ordinary or unauthenticated visitor cannot trigger it, so realistic risk is confined to malicious insiders or attackers who have already taken over a privileged account. Deployment is limited to WordPress sites running this specific plugin at or below version 3.0.8.

This is an authenticated SQL injection (CWE-89) in the WordPress plugin Ultimeter (<= 3.0.8), reported by Patchstack. The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L (score 7.6) indicates a network-reachable, low-complexity attack requiring high privileges (PR:H) and no user interaction, with a scope change (S:C), full confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L). The PR:H requirement is the dominant limiting factor: an attacker must already hold a high-privileged role (the 'Editor' context named in the title implies an authenticated back-end user), which sharply narrows the realistic threat to insiders or attackers who have already compromised a privileged account. Exploitation status is: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced in the single Patchstack advisory. There is no SSVC decision data provided. In practical terms this is a moderate, not urgent, issue: the CVSS of 7.6 is elevated mainly by S:C and C:H, but the PR:H gate and the niche footprint of the plugin make widespread opportunistic exploitation unlikely. The C:N-for-integrity but A:L pattern is consistent with a read-oriented SQLi that can also degrade availability (e.g., heavy/blind queries). No conflicting signals between the vector and description were identified; both point to authenticated network exploitation.

An attacker who holds (or has phished/compromised) a high-privileged WordPress account such as Editor/Administrator submits a crafted parameter to a vulnerable Ultimeter editor endpoint, injecting SQL into a back-end query. This lets them read arbitrary database contents (user records, password hashes, secrets) beyond their intended scope. No public POC or exploit code is currently referenced in the advisory.