EUVD-2026-90514
GHSA-wx6p-c7wj-qxp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Pro Like Button
-
ExploitSend crafted request with SQL payload
-
ExecutionInjection executes in database query
-
ImpactExtract user data and credential hashes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Pro Like Button plugin (version before 2.0) installed and active on a reachable WordPress site - exploitation is remote and unauthenticated (AV:N/PR:N/UI:N/AC:L) against default configurations. The limiting factor is not exploitability but deployment: this is a niche plugin, so the affected population is small. Upgrading to version 2.0 removes the flaw. The specific vulnerable request parameter is not named in the available intelligence, which marginally raises the effort to locate the injection point. |
| Impact | This is a genuine high-priority issue by its technical profile: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) describes a fully network-reachable, unauthenticated SQL injection with low attack complexity and no user interaction, yielding a score of 8.6 driven largely by the scope-change (S:C) flag and high confidentiality impact. However, the signal set is thin: there is no EPSS probability, no CISA KEV listing, and no public exploit code referenced, so there is no evidence of active or imminent widespread exploitation. The vector sets I:N and A:N, meaning this is assessed as a read-only (data-disclosure) SQLi rather than one enabling data modification or DoS. One point to verify: the S:C (scope change) assignment inflates the score above a typical same-authority WordPress SQLi - WPScan/NVD scoring for in-application SQLi is more commonly S:U (which would yield ~7.5); treat the 8.6 as the upper bound and the mitigating factor is the plugin's limited deployment footprint, not the exploitability. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the vulnerable endpoint, injecting SQL through an unsanitized parameter that is concatenated into a query. Because no authentication or user interaction is required (PR:N/UI:N), the attacker can automate union-based or blind extraction to read WordPress database contents such as user records and password hashes. No public proof-of-concept is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.
RemediationAI
Upgrade Pro Like Button to version 2.0 or later, which is the vendor-released patch and the only complete fix; the patch is listed as available from the vendor, so update through the WordPress plugin dashboard or redeploy the plugin from its distribution source, and verify via the WPScan advisory (https://wpscan.com/vulnerability/351a9bf8-03d4-416b-8f30-a2a87e7c4cb2/) that the running version is 2.0 or higher. If the plugin is not actively required, deactivating and removing it eliminates the exposure entirely and removes the attack surface - the trade-off is loss of the like-button functionality. Where an immediate update is not possible, the practical compensating control is to block or restrict access to the plugin's request endpoints at the WAF or reverse proxy (rule-based blocking of SQL metacharacters and UNION/boolean patterns in requests hitting the plugin path); this is only a stopgap, can be bypassed with encoding tricks, and frequently produces false positives on legitimate traffic, so it must not be treated as a substitute for upgrading. Restricting the front end to authenticated or allowlisted users would reduce exposure but defeats the purpose of a public engagement widget and still leaves the injection reachable for logged-in low-privilege users. Because the injection can read credential data, rotate WordPress user passwords and any database credentials the site uses after patching if compromise is suspected, and review database and web logs for anomalous query strings against the plugin's endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin: a parameter taken from an incoming HTTP request is concatenated or interpolated into a SQL statement without sanitization or escaping (in WordPress terms, the query is built without $wpdb->prepare() and the input is not passed through esc_sql()/absint()/sanitize_*() first). Because the injection point is reachable before authentication, the attacker controls the SQL fragment directly rather than through a privileged code path. Our independent assessment matches the vendor vector on reachability and complexity (AV:N/AC:L/PR:N/UI:N) and on high confidentiality impact (C:H), but does not adopt the vendor's scope-change flag (S:C), instead assessing S:U - the practical difference is that the injection is treated as impacting the database and assets that the WordPress site itself can access, not as a proven privilege boundary break into other components. Integrity and availability impacts are not claimed (I:N/A:N), consistent with a read-oriented data-disclosure attack, though SQL injection primitives can sometimes be chained further. The EUVD entry lists the affected range as Pro Like Button 0 through <2.0; no CPE identifiers were supplied in the available intelligence, and the specific vulnerable parameter name is not disclosed in any source, which slightly increases the reconnaissance effort needed to weaponize the issue.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi reads database contents (C:H); I/A:N as described; scope assessed S:U since the DB shares the application's security authority, unlike the vendor's S:C.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Executive ViewAI
Any internet-facing WordPress site running the Pro Like Button plugin at a version below 2.0 is exposed to an unauthenticated attacker who can read the site's database contents, including WordPress user password hashes, private and unpublished content, and data held by other plugins on the same database. Because no credentials or user interaction are required, the exposure window is simply the time between the plugin becoming reachable and being updated; leadership should care because stolen credential hashes enable follow-on account takeover and lateral movement into any environment where users reuse passwords. The plugin's narrow install base limits the population at risk, but for affected organizations the consequences are immediate and data-protection relevant.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB