Hashbar Wordpress Notification Bar
Monthly
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.