EUVD-2026-96783
GHSA-cq5j-5gfw-g5vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Recordbrowser ≤1.1.7
-
ExploitSend crafted request with injected SQL parameter
-
ExecutionAppend UNION-based query to backend
-
ImpactExtract user hashes and secrets from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Recordbrowser plugin (version ≤1.1.7) installed and active on a reachable WordPress site - the vector is AV:N/AC:L/PR:N/UI:N, so a remote unauthenticated attacker can exploit the default-configured plugin with no authentication or user interaction. The concrete prerequisite is reaching the specific plugin parameter/endpoint that passes attacker input into a SQL query without sanitisation or escaping. The only real limiting factor is deployment footprint: the plugin must be present and its vulnerable endpoint accessible; no known non-default setting is required. |
| Impact | This is a genuine priority for any site running the Recordbrowser plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile for a web vulnerability: network-reachable, low complexity, no privileges, and no user interaction - meaning a remote unauthenticated attacker can trigger it directly. The CWE-89 classification and description confirm an in-band/union-style SQL injection that extracts data, consistent with the C:H/I:N/A:N impact (confidentiality-only). WPScan (a reputable WordPress-vulnerability source) reports publicly available exploit code, which raises practical risk by lowering the skill barrier. Signals that temper the risk: there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, widespread exploitation at this time - exploit availability is not the same as confirmed in-the-wild use. The dominant mitigating factor is footprint: Recordbrowser appears to be an obscure, low-install plugin, so even a maximally exploitable bug has a small blast radius across the internet. Net: treat as high/urgent for affected installs (patch or remove immediately), but likely low-volume opportunistic scanning rather than mass exploitation. One data note: the input vector sets S:C (scope change); for a SQLi reading the WordPress database I consider scope debatable - see assessed vector and rationale. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable Recordbrowser endpoint, injecting SQL into an unsanitised parameter to append their own query (e.g. a UNION SELECT). They exfiltrate WordPress database contents such as user records and password hashes, or session/secret data. Public exploit code is available via WPScan, so no custom tooling or authentication is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
RemediationAI
No vendor-released patch version is identified in the available intelligence at time of analysis, so the primary action is to deactivate and remove the Recordbrowser plugin from any WordPress site that does not strictly require it - note the trade-off that any site functionality provided by the plugin (record browsing/display features) is lost. If the plugin must remain temporarily, place a WAF or reverse-proxy rule in front of the site that blocks SQL metacharacters and UNION/comment sequences on the plugin's request paths and parameters, accepting that signature-based filtering is bypassable and may cause false positives on legitimate input; additionally restrict access to the vulnerable endpoint to trusted source addresses if the plugin's function is administrative rather than public-facing, at the cost of blocking legitimate remote users. Because a successful injection exposes the whole database to read, treat the site as potentially compromised: rotate the WordPress database user password and any application secrets stored in the database, force password resets for privileged accounts, and review database and web access logs for enumeration patterns. Monitor the WPScan entry at https://wpscan.com/vulnerability/63e806f8-5575-4f40-9ad1-f7b391a3d6df/, the VulDB advisory at https://vuldb.com/vuln/416535, and the NVD/EUVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-89232 for the release of a fixed plugin version, and upgrade immediately once one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, SQL Injection: the plugin takes an HTTP-supplied parameter and interpolates it directly into a SQL statement without sanitisation or escaping, instead of using WordPress's $wpdb->prepare() with placeholders or strict type casting. Because the query is executed against the WordPress database with the privileges of the site's configured DB user, an attacker can break out of the intended query context, append UNION/boolean/stacked constructs, and read arbitrary rows - including wp_users password hashes, wp_usermeta capability and session data, and any plugin- or theme-stored secrets. The provided CPE (cpe:2.3:a:unknown:recordbrowser:*:*:*:*:*:*:*:*) records the vendor as unknown and the version as a wildcard, meaning every version of the plugin is treated as affected; EUVD narrows the impacted range to Recordbrowser 0 through 1.1.7. The public CVSS 8.6 vector assigns Scope:Changed (S:C), while the independent assessment scores the same flaw as S:U (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, an effective 7.5) because the injected query does not demonstrably escape the security authority of the vulnerable component - impact is a high-confidentiality read with no integrity or availability effect. The unauthenticated reachability implied by PR:N means the vulnerable code path is exposed pre-authentication (for example through admin-ajax.php, a REST route, or a front-end shortcode handler) rather than being gated behind an admin capability check.
Know when Recordbrowser gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Remote, unauthenticated, no-interaction SQLi warrants AV:N/AC:L/PR:N/UI:N and C:H; I:N/A:N as it only reads data, and S:U since the database is within the same security authority (input used S:C).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Technical POC Analysis
Class: CWE-89, SQL Injection (OWASP A1: Injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Recordbrowser WordPress plugin, present on an unknown but likely limited set of our externally facing sites, carries an unauthenticated SQL injection flaw (CVE-2026-89232) that lets any internet user read data from the site's underlying WordPress database without credentials or user interaction. Because no vendor fix exists yet and publicly available exploit code is circulating, every site still running the plugin is exposed to disclosure of user records, credentials, and other confidential content. Leadership should care because the affected data is customer- and employee-facing, and the exposure window remains open until the plugin is removed or mitigated.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Recordbrowser plugin on all WordPress instances; if it must remain active, restrict access to the affected endpoint via authentication, IP allow-listing, or network controls, and apply WAF or virtual patching rules that block SQL injection patterns against the vulnerable parameter; enforce least-privilege database accounts, enable database and web server query logging with alerting, and monitor the vendor advisory for a patched version above 1.1.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB