{"id":"CVE-2026-95610","published":"2026-10-09T10:16:43.330","lastModified":"2026-10-09T18:17:16.137","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/us-core/vulnerability/wordpress-upsolution-core-plugin-9-3-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows authenticated attackers to perform blind SQL injection attacks against the UpSolution Core plugin, potentially leading to unauthorized data access and system compromise. The flaw occurs when user input is not properly sanitized before being included in SQL queries.","exploitability":"Exploitation requires an authenticated user account with access to the UpSolution Core functionality, but once achieved, the blind SQL injection can be leveraged to extract data through time-based or boolean-based techniques.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive user data, configuration information, and potentially escalate privileges within the WordPress environment, affecting multiple sites using the vulnerable plugin version.","remediation":"Upgrade to version 9.3 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","authenticated","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:03.342Z"}}