{"id":"CVE-2026-95605","published":"2026-10-07T17:17:04.063","lastModified":"2026-10-08T17:24:31.040","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection.\n\nThis issue affects WP Data Access: from n/a through 5.5.82.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-82-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL Injection vulnerability in WP Data Access allows Blind SQL Injection, which can be exploited to extract sensitive information from the database.","exploitability":"Exploitation is moderately hard and requires the attacker to have access to the application. Precondition is the presence of user input in SQL queries.","blast_radius":"If exploited, this could lead to unauthorized data exposure, potentially compromising sensitive information stored in the database.","remediation":"Upgrade to WP Data Access 5.5.83 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sql","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:58.520Z"}}