Captivate Sync EUVD-2026-90808

Requires an authenticated high-privilege (administrator-level, PR:H) WordPress account on a site running the Captivate Sync plugin version 3.3.2 or earlier; the attacker then submits crafted input to the vulnerable plugin parameter. Exploitation is remote and needs no user interaction, but the high-privilege authentication requirement is the primary limiting factor - this is not exploitable by anonymous or low-privilege users. Because the injection is blind, successful data extraction also requires iterative boolean/time-based inference rather than direct output, modestly raising the practical effort.

This is a genuine but access-gated vulnerability that should be triaged as moderate rather than critical priority despite its 7.6 CVSS. The CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network-reachable, low-complexity exploitation requiring NO user interaction, but PR:H means the attacker must already hold high-privilege (administrator-level) WordPress credentials - this is the single biggest limiting factor and sharply narrows the realistic threat to insiders, compromised admin accounts, or multi-admin/agency sites where privilege boundaries matter. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is: no public exploit identified at time of analysis. The vendor rates scope-changed (S:C) with availability impact (A:L), which I find optimistic - a typical WordPress in-database blind SQL injection usually remains single-scope (S:U) and primarily confidentiality-affecting; I would assess C:H (full DB read including user hashes and secrets via blind boolean/time extraction) with no clear integrity or availability impact. Net: a real confidentiality risk on affected sites, but the PR:H precondition and absence of any exploitation signal (EPSS/KEV/POC) place it well below internet-wide-wormable issues. Verify the S:C and A:L claims with the vendor, as they drive the score above 7.0.

An attacker who has obtained administrator-level access to a WordPress site running Captivate Sync ≤3.3.2 - via credential theft, a reused password, or a malicious/co-admin account on a shared or agency-managed site - submits crafted input to a vulnerable plugin parameter. Because the injection is blind, they use boolean- or time-based inference to extract data row-by-row from the WordPress database, such as other users' password hashes, API keys, and session secrets. No public proof-of-concept is available at this time, and no user interaction is required once the attacker is authenticated.