{"id":"CVE-2026-42717","published":"2026-10-10T20:16:36.780","lastModified":"2026-10-13T13:28:15.717","description":"Administrator SQL Injection in Leyka <= 3.32.3 versions.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/leyka/vulnerability/wordpress-leyka-plugin-3-32-3-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in Leyka plugin versions up to 3.32.3 allows authenticated administrators to execute arbitrary SQL commands, potentially leading to full database compromise and unauthorized access to sensitive user data.","exploitability":"Exploitation requires an authenticated administrator account with access to the plugin's admin interface, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to extract all user data, modify database records, and potentially escalate privileges within the WordPress environment.","remediation":"Upgrade to Leyka version 3.32.4 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","admin-access","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:34.324Z"}}