Estatik EUVD-2026-89858

Exploitation requires an authenticated WordPress administrator account on a site running the Estatik plugin version 4.3.5 or earlier (PR:H); the attacker sends network requests to a vulnerable Estatik admin-side function with crafted SQL. The key limiting factor is the administrator prerequisite - on standard single-site installs an admin already has extensive database access, so this matters most in WordPress multisite, delegated-admin, or hardened environments where raw SQL access is not otherwise available. No user interaction is required (UI:N).

This is a CWE-89 SQL injection in the Estatik WordPress real estate plugin (<= 4.3.5), reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) describes a network-reachable, low-complexity flaw but explicitly requires high privileges (PR:H) - consistent with the description's 'Administrator SQL Injection,' meaning the attacker must already hold an administrator account. This significantly limits real-world risk: an administrator on a single-site WordPress install already has broad database and code-execution capability, so the primary added value is in multisite or delegated-role environments where an admin should not have raw SQL access, or where hardening (e.g. DISALLOW_FILE_EDIT) otherwise constrains admins. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope-change claim (S:C) and the reported 7.6 are debatable given the authenticated-admin precondition; this reads as a real-but-low-priority hardening issue rather than an urgent, widely-exploitable vulnerability. The C:H/I:N/A:L impact profile (data disclosure, minor availability, no integrity) is plausible for a blind/extraction SQLi.

An attacker who has obtained WordPress administrator credentials (via phishing, credential reuse, or a lower-privilege escalation) submits crafted input to a vulnerable Estatik plugin parameter, injecting SQL that is executed against the WordPress database to extract sensitive data such as user records or password hashes. No public POC is available, and exploitation requires an existing admin session, so this is realistic mainly in multi-admin or delegated-role deployments.