{"id":"CVE-2026-94388","published":"2026-10-16T07:17:14.430","lastModified":"2026-10-16T15:19:36.177","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/halfdata-green-popups/vulnerability/wordpress-green-popups-plugin-7-6-3-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in Green Popups allows attackers to perform blind SQL injection attacks, potentially leading to unauthorized data access and manipulation. This critical flaw affects versions before 7.6.3 and can be exploited remotely without authentication.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability allows blind SQL injection that can be leveraged through remote unauthenticated access.","blast_radius":"The impact could be significant across all Green Popups installations using affected versions, potentially exposing sensitive data and allowing attackers to manipulate database contents through crafted SQL commands.","remediation":"Upgrade to version 7.6.3 or later to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","blind-sql"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:48:16.593Z"}}