What is the CVSS score of EUVD-2026-92328?

EUVD-2026-92328 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Sirv WordPress Plugin are affected by EUVD-2026-92328?

The Sirv plugin for WordPress, in all versions through 8.2.5, contains a blind SQL injection flaw that lets anyone holding a low-privilege account on a WordPress site read from the site's backend…

How to fix or mitigate EUVD-2026-92328?

Within 24 hours, inventory every WordPress installation running the Sirv plugin at version 8.2.5 or earlier - including staging, marketing, and line-of-business sites that are often outside central asset tracking - and treat each as exposed; block or tightly restrict untrusted account registration and audit existing low-privilege accounts for unexpected creations, since a valid low-privilege WordPress session is required per the vendor description. Within 7 days, deactivate and remove the Sirv plugin wherever it is not business-critical; where it must stay for image optimization or delivery, deploy virtual patching at the WAF or reverse proxy (generic SQL-injection signatures on requests to the plugin's admin-ajax and REST endpoints), enable database query logging, and review WordPress access logs for anomalous SQL-like parameters. Within 30 days, if the plugin must remain, isolate it with least-privilege database credentials, shorten session lifetimes, rotate WordPress salts and any database passwords that plugin had access to, and continue monitoring the vendor advisory channel for a fixed release. No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Once a fixed version above 8.2.5 is published, upgrade immediately and re-validate the compensating controls can be retired.

Sirv WordPress Plugin EUVD-2026-92328

| CVE-2026-104389 HIGH

SQL Injection (CWE-89)

2026-10-05 Patchstack

GHSA-4486-36hf-vvwr

WordPress SQLi Sirv Wordpress Plugin

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable authenticated low-privilege account (PR:L), blind SQLi yields database read (C:H); I assess scope unchanged (S:U) and no integrity/availability impact absent evidence of write or DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 09:31 vuln.today

CVE Published

Oct 05, 2026 - 08:57 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 15 High Severity Oct 06, 2026

AnalysisAI

Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress session at the privilege level reflected by CVSS PR:L (a low-privilege account such as subscriber/contributor or an authenticated plugin user), and the Sirv plugin version must be 8.2.5 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-89 blind SQL injection in the Sirv WordPress plugin (versions through 8.2.5), reported by Patchstack with a vendor CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No exact fixed version is identified in the provided intelligence; the Patchstack advisory covers Sirv through 8.2.5. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WordPress installation running the Sirv plugin at version 8.2.5 or earlier - including staging, marketing, and line-of-business sites that are often outside central asset tracking - and treat each as exposed; block or tightly restrict untrusted account registration and audit existing low-privilege accounts for unexpected creations, since a valid low-privilege WordPress session is required per the vendor description. …

Threat intelligence, references, and detailed analysis are available after sign-in.