Wordpress Persistent Login
Monthly
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.