EUVD-2026-93242
GHSA-hc4m-px6m-6xx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain Subscriber account
-
ExploitSubmit crafted input to vulnerable plugin parameter
-
ExecutionTrigger SQL injection in backend query
-
ImpactExfiltrate sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at Subscriber level or above (PR:L) on a site running the vulnerable Mooberry Book Manager plugin version 4.16.2; no end-user interaction is needed (UI:N). The high attack complexity (AC:H) indicates a non-trivial precondition or that the injection is blind/conditional, meaning exploitation is not reliably one-shot. The primary limiting factors are the authentication requirement (sites that disable open user registration substantially reduce exposure) and the attack complexity; impact is confined to data disclosure (C:H) with no confirmed integrity impact (I:N). |
| Impact | This is a moderate-priority issue rather than an urgent one. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L, base 7.1) indicates a network-reachable SQL injection (CWE-89) that nonetheless requires authentication at the Subscriber level (PR:L) and carries high attack complexity (AC:H), which suppresses the score below the typical SQLi 'critical' range. Confidentiality impact is high (C:H) with no integrity impact (I:N) and only low availability impact (A:L), consistent with data-exfiltration-style SQL injection. No EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent widespread exploitation - the signals are internally consistent (high CVSS driven by data exposure, but gated by auth + complexity) and point to a vulnerability worth patching on a normal cycle rather than an emergency. The single caveat: the AC:H and S:C choices from Patchstack are not explained in the description, so the real-world difficulty of triggering the injection cannot be independently verified from the data provided. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privileged Subscriber account on a WordPress site running Mooberry Book Manager 4.16.2 and sends crafted input to a plugin endpoint that fails to sanitize a parameter used in a SQL query. By injecting SQL (likely requiring some trial-and-error given the high attack complexity), the attacker reads sensitive data from the WordPress database, such as other users' details or password hashes. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
RemediationAI
No vendor-released patch was identified at the time of analysis, so administrators should first check the Mooberry Book Manager plugin page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mooberry-book-manager/vulnerability/wordpress-mooberry-book-manager-plugin-4-16-2-sql-injection-vulnerability?_s_id=cve) for a fixed release before acting; if the plugin is not business-critical, deactivating and removing it is the cleanest mitigation and eliminates the attack surface entirely. Where the plugin must remain active, the highest-value compensating control is closing the account prerequisite: disable open user registration (Settings > General > Membership), audit and remove unused Subscriber accounts, and block self-service account creation on any site running the plugin - the trade-off is loss of legitimate self-registration and the need for an administrator-mediated onboarding process. Reducing the database privileges of the WordPress database user (revoking FILE, and limiting to the privileges WordPress actually needs) constrains what a read-oriented injection can reach, but WordPress core and many plugins assume broad rights, so expect breakage in backups, updates or plugin installs. Deploying a WAF or reverse-proxy rule set that inspects requests to the plugin's AJAX/REST endpoints for SQL metacharacters offers interim protection with a real risk of false positives on legitimate book-search or filtering requests, so tune in monitor-only mode first. Finally, monitor the vendor changelog and apply the patched version as soon as it ships, and review database and web logs for anomalous query strings against wp-admin/admin-ajax.php as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin. WordPress plugins interact with the site database through the $wpdb abstraction layer, and injection occurs when attacker-controlled input is concatenated directly into a query string instead of being passed through parameterized placeholders such as $wpdb->prepare() with %s/%d types, or escaped via esc_sql(). The patch status and CPE record (cpe:2.3:a:mooberrydreams:mooberry_book_manager:*:*:*:*:*:*:*:*) show the vendor component is tracked with a wildcard version range, meaning the advisory is pinned to plugin release 4.16.2 but broader version exposure cannot be excluded from the CPE alone. The vulnerable code path is reachable with the privileges of a Subscriber - the lowest standard WordPress role - which indicates the endpoint lacks a meaningful capability check (for example current_user_can() or a role restriction) and, typically, a nonce/CSRF validation on the AJAX or REST handler that processes the input. Because the affected data store is the shared WordPress MySQL/MariaDB database in which users, options, posts and plugin tables all reside, a successful injection can expose sensitive rows well beyond the plugin's own tables. The assessed impact is confidentiality-only (C:H, I:N), consistent with a read-oriented injection such as a UNION- or boolean/error-based extraction rather than a stacked-query write.
Know when Mooberry Book Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable SQLi exploitable by a low-privileged Subscriber (PR:L); SQL injection is typically straightforward (AC:L); impact is database read disclosure (C:H) with no integrity or availability effect and no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
Executive ViewAI
The Mooberry Book Manager plugin for WordPress (version 4.16.2) contains a SQL injection flaw that lets an attacker with a low-privilege Subscriber-level account read arbitrary data from the site's underlying WordPress database. Organizations that run this plugin alongside open user registration or membership sign-up are the most exposed, since obtaining the required account may be trivial on those sites. Leadership should care because the confirmed impact is disclosure of database contents - including potentially sensitive user and business data - and no vendor patch is currently available to close the gap.
No vendor patch is available, so interim mitigations are required: deactivate or remove the Mooberry Book Manager plugin where feasible; disable or tightly control open user registration and Subscriber account provisioning; enforce least privilege and audit existing low-privilege accounts; deploy and tune WAF/database activity monitoring rules for SQL injection attempts against plugin endpoints; segment or restrict database access; and monitor logs for unauthorized data reads until a vendor fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB