Admin Notices Manager EUVD-2026-89879

Requires an authenticated WordPress Administrator account (PR:H) on a site running the Melapress Admin Notices Manager plugin at version 1.6.0 or earlier; the attacker submits malicious input to a plugin-handled parameter that is concatenated into a SQL query. No user interaction (UI:N) and network-reachable (AV:N) once authenticated. The dominant limiting factor is the administrator privilege prerequisite: the actor must already hold top-tier site access, which sharply narrows the realistic threat population to multi-admin, delegated-role, or managed-hosting scenarios, or a scenario where a lower-privilege foothold is escalated to admin first.

This is a high-CVSS score (7.6) that reflects low real-world urgency once the CVSS vector is read carefully. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L requires PR:H - an already-authenticated WordPress Administrator, the highest privilege tier in a standard install. An attacker who is already an administrator can typically export or alter the database through legitimate means, so the marginal risk added by this SQL injection is limited; it is primarily relevant in multi-admin, managed-hosting, or delegated-role environments where separation of duties or database-layer isolation matters, or where a lower-privilege compromise is chained upward. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation is not confirmed or predicted to be widespread. No SSVC decision data was supplied. The one contrast worth noting: the vendor set S:C (scope change) and C:H, which elevates the score, but the PR:H prerequisite is the dominant limiting factor and keeps genuine priority low-to-medium. No conflicting signals between the description and the vector - both point to an administrator-only SQL injection.

A user holding a WordPress Administrator account on a site running Admin Notices Manager <= 1.6.0 submits a crafted value to an unsanitized parameter handled by the plugin, which is concatenated into a SQL query. The injected SQL executes against the WordPress database, allowing extraction of sensitive data (e.g., user records, password hashes, secrets) beyond the plugin's intended scope. No public proof-of-concept was identified at time of analysis, and exploitation requires an existing high-privilege account.