{"id":"CVE-2026-96345","published":"2026-09-30T13:17:29.430","lastModified":"2026-09-30T14:18:08.217","description":"Administrator SQL Injection in Estatik <= 4.3.5 versions.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-3-5-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows an attacker to inject malicious SQL commands, potentially leading to data theft or corruption. It matters because it can be exploited by unauthorized users to gain control over the database.","exploitability":"Exploitation requires administrative access and knowledge of the SQL injection vulnerability. It is moderately difficult to exploit.","blast_radius":"If exploited, the impact could be significant, as it could lead to data breaches or corruption affecting all users of the system.","remediation":"Upgrade to Estatik 4.3.6 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","web","data-breach"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:46:04.630Z"}}