{"id":"CVE-2026-121769","published":"2026-11-09T19:16:46.130","lastModified":"2026-11-10T19:20:32.187","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-w3all-phpbb-integration/vulnerability/wordpress-wp-w3all-phpbb-plugin-3-1-9-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection flaw exists in the WP w3all phpBB integration plugin due to improper neutralization of user-supplied input in SQL queries. This allows authenticated low-privilege users to manipulate database queries and exfiltrate sensitive data.","exploitability":"Exploitation requires low-privileged authentication (e.g., a registered WordPress user with minimal permissions) and no user interaction, making it feasible for compromised accounts or weakly secured endpoints.","blast_radius":"Successful exploitation could lead to full database compromise including user credentials, personal data, and potentially privilege escalation if administrative data is accessed.","remediation":"Upgrade to WP w3all phpBB version 3.1.10 or later, as the vulnerability is fixed in that release.","detection":"Defenders should monitor WordPress debug logs and web server access logs for SQL error messages (e.g., 'You have an error in your SQL syntax'), unusual patterns of single quotes or UNION-based payloads in POST/GET parameters targeting wp-admin/admin-ajax.php or plugin-specific endpoints, and repeated failed queries from authenticated users.","tags":["sql-injection","web","auth-bypass","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:49:20.354Z"}}