EUVD-2026-95596
GHSA-c4q9-w4vh-p5h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged WordPress account
-
DeliverySend crafted request to us-core endpoint
-
ExploitInject blind SQL payload
-
ExecutionInfer database contents via responses
-
ImpactExfiltrate credentials and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with at least low privileges (CVSS PR:L) on a site running UpSolution Core up to and including version 9.3; the attacker must reach the specific vulnerable us-core parameter/endpoint, and because the injection is blind, extraction relies on inferential (boolean/time-based) techniques rather than direct output. Limiting factors: the account prerequisite means sites that disable self-registration and restrict low-trust accounts substantially raise the bar, and the precise vulnerable feature/endpoint is not named in the available data (not disclosed by Patchstack publicly), so the exact triggering configuration could not be confirmed. |
| Impact | This is a genuine but conditional priority rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates network-reachable, low-complexity exploitation that nonetheless requires authentication (PR:L) - meaning an attacker needs at least a low-privileged WordPress account before the blind SQL injection can be triggered. No EPSS score was supplied, there is no CISA KEV listing, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent (classic authenticated plugin SQLi reported by Patchstack) but thin on real-world exploitation evidence. One point to verify: the input marks Scope as Changed (S:C), which is unusual for a plugin-level SQL injection that typically operates within the WordPress database boundary - this inflates the base score and should be confirmed with the vendor/Patchstack rather than treated as settled. Overall, prioritize patching on sites that allow self-registration or have many low-trust accounts, where PR:L is trivially satisfied; deprioritize relative to unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker who holds or registers a low-privileged WordPress account (e.g., subscriber/contributor on a site with open registration) sends a crafted request to a vulnerable UpSolution Core endpoint, injecting SQL that is executed blind against the WordPress database. By observing boolean or time-based response differences, they iteratively extract sensitive data such as password hashes, secret keys, or user PII. No public exploit code is referenced, so this is a plausible rather than demonstrated chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis; the affected range reported by Patchstack runs through version 9.3 and no fixed version is stated, so administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/us-core/vulnerability/wordpress-upsolution-core-plugin-9-3-sql-injection-vulnerability?_s_id=cve and apply the exact patched release as soon as the vendor publishes it. If the plugin is not essential, deactivating and removing UpSolution Core eliminates the exposure entirely, at the cost of losing any theme or layout functionality it provides. Because exploitation requires an authenticated low-privilege session, the most effective compensating control is to shrink the low-trust account population: disable open user self-registration, and review and remove or downgrade stale subscriber, contributor, and author accounts; the trade-off is operational overhead and possible disruption to legitimate multi-author workflows. Enforce least privilege on the WordPress database user (SELECT-only where the site tolerates it) to cap what an injected query can read, understanding that this may break plugin features that write data. Deploy virtual patching or WAF rules that inspect and block SQL metacharacter patterns in requests to us-core endpoints and admin-ajax/admin-post.php calls referencing the plugin; this is a stopgap that risks false positives and can be bypassed by encoding tricks. Finally, since the vulnerable parameter and endpoint are not publicly disclosed, targeted configuration hardening is not possible, so log and audit authenticated requests touching UpSolution Core, and treat any anomalous boolean- or delay-pattern traffic from low-privilege sessions as presumptive compromise requiring credential rotation and database review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the UpSolution Core WordPress plugin. The plugin builds database queries by concatenating user-influenced input instead of using parameterized statements or prepared queries with bound placeholders, so metacharacters such as single quotes and SQL operators survive into the executed statement. Because the injection point returns no query results to the attacker, the flaw is blind: exploitation depends on conditional responses, typically boolean-based (comparing true/false page states) or time-based (measuring induced delays) payloads to infer one bit of data at a time. The only CPE supplied, cpe:2.3:a:upsolution:upsolution_core:*:*:*:*:*:*:*:*, is a wildcard-version entry for the plugin, and the vendor advisory scopes affected installations as versions up to and including 9.3; no fixed version is stated in the available data. The discrepancy between the vendor vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) and our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) turns on scope and availability: we did not confirm that the vulnerable component can affect resources beyond its own security authority, nor that the injection reliably degrades availability, so we scored S:U and A:N. The specific vulnerable parameter or endpoint is not publicly named by Patchstack, so the exact triggering configuration could not be confirmed.
Know when Upsolution Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable blind SQLi needing a low-privileged account (PR:L); primary impact is database read (C:H), with scope kept Unchanged as injection stays within the DB and no integrity/availability impact is established.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.
Executive ViewAI
A blind SQL injection flaw affects the UpSolution Core WordPress plugin (us-core) through version 9.3, and no vendor fix is currently available. Exploitation requires an attacker to already hold a low-privilege authenticated WordPress account, so the practical exposure is limited to sites where untrusted users can obtain accounts (subscribers, contributors, customers, community members). Successful abuse would let such an actor infer and extract database contents, exposing stored credentials, customer records, or other sensitive data - a confidentiality-only impact that leadership should treat as a conditional but real risk rather than an emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the UpSolution Core (us-core) plugin on non-essential sites; restrict and audit WordPress accounts holding any authenticated role so untrusted users cannot obtain a low-privilege session; enforce least privilege on WordPress roles and database accounts; deploy WAF or reverse-proxy rules to detect and block boolean- and time-based SQL injection patterns against the vulnerable parameter; increase monitoring of authentication and database activity for inference-style query behavior; rotate database credentials and secrets stored in the affected database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Upsolution Core
View allA Reflected Cross-Site Scripting (XSS) vulnerability exists in UpSolution Core plugin versions through 8.41, allowing at
Reflected cross-site scripting (XSS) in the UpSolution Core (us-core) WordPress plugin through version 8.44 allows unaut
Exploit-DB