W4 Post List EUVD-2026-85649

Requires an authenticated high-privilege WordPress account (PR:H - administrator or equivalent with access to W4 Post List plugin functionality) on a site running W4 Post List version 3.0.6 or earlier. Exploitation is remote over the network with low complexity and no user interaction, but is gated entirely by the high-privilege authentication requirement - an unauthenticated or low-privilege user cannot reach the vulnerable code path. No specific non-default configuration beyond having the vulnerable plugin installed and active is indicated by the available data.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6 HIGH) describes a network-reachable, low-complexity blind SQL injection, but the PR:H requirement is the dominant risk-limiting signal: exploitation requires an already-authenticated high-privilege account (in a WordPress plugin context this typically means an administrator or equivalent with access to the plugin's settings/query functionality). That materially reduces real-world urgency - an attacker who already holds admin-level WordPress access has far more direct avenues than blind SQLi. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. I also question two vendor metric choices: S:C (scope change) is questionable for SQLi confined to the site's own database, and A:L is weakly justified - a blind SQLi that reads data more naturally lands at C:H/A:N. Net: this is a genuine confidentiality-affecting flaw but a moderate, not top-tier, priority given the high-privilege precondition, niche plugin footprint, and absence of exploitation signals. Vendor data is thin (single Patchstack reference, no fix version listed), so affected-version and patch details should be verified directly with the vendor/Patchstack.

An authenticated high-privilege WordPress user (administrator or equivalent) submits crafted input to a W4 Post List plugin parameter that is concatenated unsanitized into a SQL query, then uses boolean/time-based blind techniques to infer database contents character by character. Over repeated requests the attacker extracts sensitive data such as user password hashes, secret keys, or other WordPress table contents. No public proof-of-concept was provided.