EUVD-2026-96446
GHSA-2c9c-5f7m-8fpr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or use subscriber account
-
ExploitSend crafted request with SQL payload
-
ExecutionInjection executes in WordPress database
-
ImpactExfiltrate credentials and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid WordPress account at the Subscriber role or higher (PR:L), so the target site must permit user registration (or the attacker must otherwise obtain subscriber credentials); exploitation then needs no user interaction (UI:N) and succeeds remotely over the network against the Qode Tours plugin at version <= 3.1.3.2. The practical limiting factor is the authentication requirement combined with whether open/self-service registration is enabled - sites that disable public registration substantially reduce exposure. No special non-default plugin configuration is indicated in the available data beyond the plugin being installed and active. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates a network-reachable, low-complexity SQL injection requiring only low-level authentication (PR:L) - consistent with the title 'Subscriber SQL Injection', meaning any user who can self-register at the lowest WordPress role can exploit it. The high confidentiality impact (C:H) reflects the ability to read arbitrary database contents (user hashes, secrets), while I:N/A:L suggests limited integrity/availability effect. No EPSS score, CISA KEV entry, or public PoC is present in the provided data, so exploitation is 'no public exploit identified at time of analysis'; the 8.5 is a capability-based (not activity-based) score. Net assessment: a genuinely meaningful authenticated flaw - low privilege bar plus high data-exposure - but real-world risk is bounded by two conditions the vendor-assigned vector understates: (1) the site must allow subscriber registration, and (2) no evidence of active exploitation exists. The S:C (scope change) rating is atypical for a read-oriented SQLi and should be verified with Patchstack, as independent assessment favors S:U. |
| Exploit ScenarioDerived | An attacker self-registers (or uses an existing low-privilege subscriber account) on a WordPress site running the Qode Tours plugin, then sends a crafted request to a vulnerable plugin endpoint containing malicious SQL in an insufficiently sanitized parameter. The injected query is executed against the WordPress database, letting the attacker extract sensitive data such as user credentials and secret keys. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means exploitation is straightforward once a subscriber account is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
RemediationAI
No vendor-released patch version is identified in the available data, and the supplied reference is the Patchstack advisory entry for the plugin (https://patchstack.com/database/wordpress/plugin/qode-tours/vulnerability/wordpress-qode-tours-plugin-3-1-3-2-sql-injection-vulnerability), which should be checked directly for the current fixed release before assuming one exists; the advisory's '<= 3.1.3.2' boundary implies a later release is the intended fix, so upgrade to the newest vendor-published version as soon as it is confirmed rather than assuming 3.1.3.2 itself is safe. Until a fixed build is verified, the single highest-value compensating control is to disable open self-service WordPress registration (Settings > General > Membership) or restrict it to invite-only, because the vulnerability requires at least Subscriber-level authentication and this removes the attacker's cheapest path to a valid account; the trade-off is loss of self-service signup and any features that depend on it. Complement that by auditing and pruning existing low-privilege accounts, deactivating and deleting the Qode Tours plugin entirely if the tours functionality is unused (the plugin's data is retained in the database but is no longer queryable, which is the cleanest removal of the attack surface), and deploying WAF or virtual-patching rules that inspect query strings for SQL metacharacters on requests carrying Subscriber cookies; WAF coverage has real bypass risk and does not fix the underlying defect, but it meaningfully raises the cost of automated scanning. Finally, review database and web server logs for anomalous UNION SELECT, SLEEP(), or information_schema patterns from authenticated sessions at the Subscriber role, and treat any such hits as evidence that credential and configuration data may already have been exfiltrated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Qode Tours is a WordPress plugin (CPE cpe:2.3:a:qode:qode_tours:*:*:*:*:*:*:*:*) and the flaw is a classic CWE-89 improper neutralization of special elements used in an SQL command. The plugin builds SQL statements passed to the WordPress database layer without sufficient parameterization or escaping via $wpdb->prepare(), so attacker-controlled request parameters reach the query string and permit UNION/boolean/stacked-style data extraction. The published advisory from Patchstack titles this a 'Subscriber SQL Injection', which maps directly to the CVSS vector supplied with the record: AV:N/AC:L/PR:L/UI:N, meaning the vulnerable endpoint is reachable over the network and can be triggered by any account at the Subscriber role or above with no interaction from an administrator. The two impact models differ in useful ways: the published vector claims S:C with C:H/I:N/A:L (8.5), while the independent assessment narrows this to S:U with C:H/I:N/A:N, i.e. the same high confidentiality loss but no demonstrable cross-boundary scope change and no confirmed availability impact. Either way the root cause class is the same, and the practical privilege floor is what distinguishes this bug from the more commonly mass-exploited unauthenticated WordPress SQL injections.
Know when Qode Tours gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Subscriber account needed so PR:L; network/low-complexity/no-UI per SQLi reachability; read-oriented injection yields C:H with no integrity/availability impact and no cross-component scope change (S:U), diverging from the vendor's S:C/A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
Executive ViewAI
A high-severity SQL injection flaw in the Qode Tours WordPress plugin, affecting all releases up to and including version 3.1.3.2, allows anyone with a basic Subscriber-level account to extract the site's user credentials and configuration data. Any organization running this plugin with open self-service registration is effectively handing attackers the account needed to exploit it, putting WordPress administrative credentials and ultimately downstream connected systems at risk. Because no vendor patch currently exists, leadership should treat exposure reduction as an immediate operational decision rather than a routine update task.
No vendor-released patch identified at time of analysis. Interim mitigations: disable open self-service registration to remove the low-privileged account prerequisite; deactivate or remove the Qode Tours plugin on internet-facing sites; restrict and audit Subscriber accounts; deploy WAF/virtual patching rules for SQL injection on plugin endpoints; rotate potentially exposed WordPress credentials; and monitor database and authentication logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB