EUVD-2026-89836
GHSA-5hmh-xj6h-v224
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on target site
-
ExploitSubmit crafted input to vulnerable plugin parameter
-
ExecutionInjected SQL executes against WordPress DB
-
ImpactExtract sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with at least Contributor role on a WordPress site running Easy Pricing Tables version 4.1.2 or earlier - this is the key limiting factor, as anonymous visitors cannot trigger it. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L) once the Contributor account is held. Realistic exposure is therefore highest on multi-author sites, sites permitting open user registration that grants Contributor, or sites where an attacker can otherwise obtain low-privilege credentials; single-admin sites with registration disabled face substantially lower risk. |
| Impact | This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-reachable, low-complexity SQL injection requiring only Contributor-level privileges (PR:L) and no user interaction. The high score is driven largely by Patchstack's Scope:Changed judgment and C:H - an authenticated Contributor reaching the site database confirms a real trust-boundary crossing. However, several exploitation-likelihood signals are absent: no EPSS score was provided, the CVE is not on CISA KEV, and no public POC is referenced, so this is 'no public exploit identified at time of analysis.' The practical constraint is the Contributor requirement - the attacker must already hold (or register for, on sites allowing self-registration) a Contributor account, which limits mass unauthenticated exploitation. Net: a real, patchable authenticated-SQLi worth prioritizing on multi-author WordPress sites, but not an unauthenticated internet-wide emergency. Note the S:C and A:L metrics are Patchstack's; SQL read-only injection is often better modeled as S:U with A:N, which would lower the score - worth verifying against the actual sink. |
| Exploit ScenarioDerived | An attacker holding or self-registering a Contributor account on a WordPress site running Easy Pricing Tables <= 4.1.2 submits a crafted parameter to a plugin endpoint that is concatenated into a SQL query without proper sanitization. This lets them extract sensitive data (user records, password hashes, secrets) from the WordPress database. No public exploit code is currently referenced, but the vulnerability class is well understood and Patchstack has confirmed the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to check the Easy Pricing Tables plugin page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-pricing-tables/vulnerability/wordpress-easy-pricing-tables-plugin-4-1-2-sql-injection-vulnerability?_s_id=cve for a fixed release and upgrade the plugin as soon as one is published; until then, if the plugin is not business-critical, the safest option is to deactivate it, accepting the loss of pricing-table functionality. Because exploitation is gated on the Contributor role, the highest-value compensating control is to suppress that role on untrusted accounts: disable open user registration where it is not required, remove or downgrade the Contributor capability from any self-service registration flow, and audit existing users with Contributor or above for accounts that should not have them - the trade-off is reduced self-service publishing and content workflow for legitimate authors. Deploying WAF or reverse-proxy SQL injection signatures against requests to the plugin's endpoints and WordPress admin-ajax/frontend routes reduces automated exploitation but can be bypassed by encoded payloads and may generate false positives on legitimate table configuration requests. Where the plugin must stay active, restrict author accounts to a trusted group, enable database activity monitoring or WordPress audit logging to detect anomalous SELECT/UNION patterns originating from authenticated sessions, and consider rotating WordPress authentication salts and resetting privileged credentials if compromise is suspected, since the injection gives read access to data that could include password hashes and session material.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-89 SQL injection in a WordPress plugin from FatCat Apps distributed through the WordPress.org plugin repository, identified by the CPE cpe:2.3:a:fatcatapps:easy_pricing_tables:*:*:*:*:*:*:*:*. WordPress plugins commonly interact with the database via $wpdb and unprepared, unescaped query strings; when attacker-controlled input from a privileged-but-low-trust role is concatenated into a query instead of being bound with wpdb->prepare(), the database executes attacker-supplied SQL. The Contributor role in WordPress can create and manage its own posts but cannot publish; reaching the vulnerable code path with only that capability means the plugin fails to enforce capability and nonce checks appropriate to the operation being performed. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), high confidentiality impact (C:H), and low availability impact (A:L) - a read-oriented data-exfiltration profile consistent with UNION-based or blind extraction of database contents. Note the scoring divergence: the supplied vendor score (8.5) asserts scope change (S:C) while the independent assessment places scope at Unchanged (S:U); the independent assessment is the authoritative view used here, and it slightly lowers the effective severity even though the confidentiality impact remains high.
Know when Easy Pricing Tables gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Contributor login gives PR:L over a network, low-complexity SQLi; DB read yields C:H, but I assess S:U (no confirmed cross-component escape) rather than Patchstack's S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Executive ViewAI
Easy Pricing Tables, a WordPress plugin used on pricing and comparison pages, carries a vulnerability in versions up to and including 4.1.2 that allows an account with Contributor-level access to read sensitive data directly from the site's database, including user credential hashes, password reset tokens, and stored configuration. No vendor-released patch has been identified at time of analysis and no public exploit code has been identified at time of analysis, but the low privilege threshold means any site granting Contributor access broadly - multi-author blogs, membership or community sites with open registration, or any site where an attacker can obtain low-privilege credentials - faces site-wide credential compromise. Leadership should care because a single low-trust account can expose the authentication material for every user on the platform, with downstream risk of account takeover and lateral movement into connected systems.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Easy Pricing Tables plugin; restrict and audit Contributor-level accounts and disable open registration; enforce least-privilege role assignments; apply WAF/virtual-patch rules against SQL injection patterns targeting the plugin; enable database activity monitoring and log review; rotate credentials if compromise is suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Easy Pricing Tables
View allThe Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputti
The Pricing Tables WordPress Plugin - Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Script
Exploit-DB