Vitepos WordPress Plugin EUVD-2026-94942

Exploitation requires an authenticated high-privilege account on the WordPress site running the Vitepos / vitepos-lite plugin at version 3.6.1 or earlier (CVSS PR:H), which is the primary limiting factor and excludes anonymous internet attackers. Beyond that, exploitation is remote over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), targeting a plugin input that is improperly neutralized before use in a SQL command. The exact vulnerable feature, endpoint, or parameter is not specified in the provided description, so defenders should consult the Patchstack advisory for the precise injection point; the main realistic barrier remains obtaining the required privileged session.

This is a blind SQL injection (CWE-89) in the Appsbd Vitepos / vitepos-lite WordPress plugin, reported by Patchstack with a CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). The network vector and low attack complexity favor exploitation, but the decisive mitigating signal is PR:H - the CVSS vector confirms the attacker must already hold high-privilege (authenticated) access, which sharply narrows the realistic threat to insiders or attackers who have already compromised a privileged account. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or probable near-term exploitation. The CVSS impact profile is internally unusual: a blind SQL injection most naturally yields confidentiality impact (C:H, consistent here), yet it reports I:N with A:L, which is an atypical pairing for SQLi and appears to reflect Patchstack's conservative scoring rather than a measured availability effect - verify impact scope with the vendor/Patchstack advisory. The scope-changed flag (S:C) inflates the base score; for a plugin querying its own WordPress database this is debatable. Net assessment: a genuine but not urgent issue - high-privilege prerequisite plus absence of any exploitation signal places it well below internet-facing, unauthenticated priorities.

An authenticated user with a high-privilege role (or an attacker who has hijacked such an account) submits crafted input to a vulnerable Vitepos plugin parameter that is concatenated into a SQL query. Because the injection is blind, the attacker infers data by observing conditional response differences or timing, gradually extracting WordPress database contents such as user records and secrets. No public exploit code was identified at time of analysis, and exploitation requires the pre-existing privileged session indicated by CVSS PR:H.