EUVD-2026-96781
GHSA-4378-6836-v93j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Llavero.io ≤0.1.4
-
ExploitSend crafted request with malicious SQL in vulnerable parameter
-
ExecutionInjection executes against backend database
-
ImpactExfiltrate sensitive data from database tables
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Llavero.io WordPress plugin version 0.1.4 or earlier be installed and active on an internet-reachable WordPress site; the description names no special feature toggle or non-default configuration, and the CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is needed. The injection targets a single unsanitized parameter used in a SQL statement and yields read-only data disclosure. The principal limiting factor is prevalence: the vulnerable component is a niche, early-version plugin, so the exposed population is small, and impact is confined to confidentiality (no data modification or denial of service). |
| Impact | Signals are mostly aligned toward a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vulnerability, and WPScan-sourced public exploit code exists, so a weaponizable path is real. However, no EPSS score and no CISA KEV entry were provided, so there is no evidence of active, widespread exploitation - public PoC availability is NOT the same as in-the-wild use. The headline 8.6 is inflated by the vendor's Scope:Changed choice; for a read-only SQL injection I assess S:U (base ~7.5) as more defensible, so treat the severity as High rather than near-critical. SSVC-style read: exploitation status is PoC-only, the flaw is plausibly automatable given unauthenticated network access, but technical impact is partial (confidentiality-only data disclosure, no write/integrity or availability impact). Net: a real, patch-worthy issue for anyone running this specific plugin, but its overall risk is tempered by the plugin's very small deployment footprint and the absence of KEV/EPSS evidence of mass exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Llavero.io ≤ 0.1.4, injecting malicious SQL into an unsanitized parameter to extract database contents such as user records and secrets. Public exploit code from WPScan lowers the bar, and the low attack complexity with no authentication or user interaction means the request can be issued directly against a default installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is named in the available references, so the primary action is to deactivate and delete the Llavero.io plugin from any WordPress installation until an updated release is published - for an early-0.x, niche plugin the functional trade-off of removal is typically minimal and it eliminates the attack surface entirely. If removal is not immediately possible, interim compensating controls include a WAF or reverse-proxy virtual-patch rule blocking SQL-injection patterns (UNION, stacked queries, comment/quote obfuscation) on requests targeting the plugin's endpoints, accepting that such rules are bypassable by encoding tricks and can generate false positives; alternatively, block or restrict access to the plugin's paths at the web server for all but trusted IPs, which may break legitimate front-end functionality the plugin provides. Because the impact is read-only database disclosure, operators who have already run the plugin should review database and web access logs for anomalous query patterns or unexpected outbound traffic, and should treat any data exposed by the plugin's tables as potentially compromised. Monitor the WPScan entry (https://wpscan.com/vulnerability/3f190943-997c-4b94-b760-51532b61427f/) and the VulDB advisory (https://vuldb.com/vuln/416533) for a patched version, and apply it as soon as one is released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin: a request parameter is passed into a SQL statement without sanitization or escaping (and without use of WordPress's $wpdb->prepare()/prepared-statement patterns), letting the attacker reshape the query and exfiltrate rows from the underlying MySQL/MariaDB database. The affected code is Llavero.io through version 0.1.4, an early-0.x WordPress plugin; the supplied CPE (cpe:2.3:a:unknown:llavero.io:*:*:*:*:*:*:*:*) uses an unresolved 'unknown' vendor, reflecting that the component is not well catalogued in NVD's vendor dictionary and has low adoption. Because the CVSS vector carries PR:N and UI:N (per both the reported vector and the independent assessment), the vulnerable endpoint is reachable without a session, so any internet-facing site with the plugin active is directly exposed. Note the one discrepancy between sources: the reported vector scores S:C (scope change), while the independent assessment sets S:U, narrowing the claim to a single-component, read-only confidentiality impact with no integrity or availability loss. ENISA tracks the same issue as EUVD-2026-96781.
Know when Llavero Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi over the web, so AV:N/AC:L/PR:N/UI:N; read-only disclosure gives C:H, I:N, A:N; I assess S:U rather than the vendor's S:C for a standard in-app SQLi.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
Technical POC Analysis
Evidence caveat up front: the sole source is the WPScan advisory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Llavero.io WordPress plugin (versions through 0.1.4) exposes sites to an unauthenticated SQL injection that can allow remote attackers to read the underlying WordPress database. Organizations running this plugin, particularly public-facing WordPress sites, should treat the issue as a confidentiality risk because publicly available exploit code exists and no vendor-released patch is currently identified. Leadership should prioritize discovery and removal or virtual patching, even though the plugin's niche, early-version footprint may limit broad exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing the Llavero.io plugin (versions through 0.1.4) if it is not essential, deploying WAF or virtual patching to block SQL injection attempts against the plugin's endpoints, applying least-privilege database permissions, restricting network access where feasible, and monitoring WordPress and database logs for anomalous read activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB