WOLF bulk-editor EUVD-2026-98368

Exploitation requires an authenticated WordPress user with high privileges (CVSS PR:H - effectively administrator or an account with access to the WOLF bulk-editor interface), who then injects SQL through the plugin's bulk-editing input. The affected component is the WOLF bulk-editor plugin by PluginUs.Net at versions up to and including 1.1.1. Key limiting factors: the attacker must already hold elevated/authenticated access (no unauthenticated path), and the injection is blind (data is inferred indirectly, not returned directly), which slows exfiltration. No user interaction by a victim is required (UI:N).

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base of 7.6 is driven largely by the scope-change flag (S:C) and network vector (AV:N) combined with high confidentiality impact (C:H), but the single most important mitigating signal is PR:H - exploitation requires an already highly-privileged (effectively administrator-level) authenticated WordPress account. A blind SQL injection reachable only by an admin is a meaningfully lower real-world risk than an unauthenticated SQLi, since an admin already has broad access to the site and its data. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the source data, so exploitation status is: no public exploit identified at time of analysis. One internal tension to flag: the vector asserts S:C (scope change) and A:L (availability impact), which is generous for a read-oriented blind SQLi; a blind injection that only exfiltrates data would more typically be S:U with A:N, so the 7.6 should be treated as a vendor/Patchstack upper-bound rather than a confirmed field severity. Net: patch in the normal cycle, prioritize if untrusted or lower-tier admin accounts exist on the site.

An attacker who has obtained a high-privilege WordPress account (or a malicious/compromised administrator) sends crafted input through the WOLF bulk-editor functionality, injecting SQL that the plugin fails to neutralize. Because the flaw is a blind injection (CVSS I:N), the attacker infers database contents through boolean/time-based responses rather than direct output, ultimately reading sensitive data such as user records or secrets. No public proof-of-concept was provided, and exploitation depends on first holding the required elevated privileges.