{"id":"CVE-2026-42416","published":"2026-10-06T09:17:54.610","lastModified":"2026-10-06T15:04:25.990","description":"Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/u-design-core/vulnerability/wordpress-udesign-core-plugin-4-15-0-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in UDesign Core plugin allows authenticated attackers to execute arbitrary SQL commands against the WordPress database, potentially leading to full database compromise and unauthorized access to sensitive user data.","exploitability":"Moderately difficult to exploit as it requires an authenticated user account with subscriber-level privileges, but the attack surface is relatively narrow with predictable input handling.","blast_radius":"The impact could be significant across multiple WordPress sites using UDesign Core versions 4.15.0 or earlier, potentially exposing thousands of user accounts and their associated data.","remediation":"Upgrade to UDesign Core version 4.15.1 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","authenticated","database"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:24.860Z"}}