rootpwn

critical · CVSS v3 9.8

CVE-2026-87767

The WP Shortcut Link and Advertisement Banner WordPress plugin up to version 1.2.0 suffers from an unauthenticated SQL injection vulnerabili

Overview

The WP Shortcut Link and Advertisement Banner WordPress plugin up to version 1.2.0 suffers from an unauthenticated SQL injection vulnerability via an AJAX action. The flaw exists because user-supplied input is not properly sanitized or escaped before being processed in a database query. This allows remote, unauthenticated attackers to extract sensitive information directly from the underlying database.

Description

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Impact

This vulnerability severely impacts the Confidentiality, Integrity, and Availability of the affected WordPress site by potentially exposing sensitive database contents, including user credentials and site data. Unauthenticated external attackers can exploit this flaw remotely without requiring any prior privileges or user interaction. Successful exploitation gives unauthorized actors deep access to backend data stores.

Remediation

Disable and uninstall the WP Shortcut Link and Advertisement Banner plugin immediately until a patched version is officially released by the vendor. Implement Web Application Firewall (WAF) rules to block suspicious SQL injection patterns targeting AJAX endpoints. Restrict access to admin-ajax.php or monitor database query logs for anomalous activity.

Risk context

Rated as critical with a CVSS v3 score of 9.8 due to the unauthenticated nature of the flaw and the severity of potential database compromise. Immediate defensive action is recommended to mitigate unauthorized data access risks.

Affected products

  • WP Shortcut Link and Advertisement Banner plugin

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

SQLi WordPress Plugin Unauthenticated AJAX Web Application

← All CVEs

Related CVEs

critical

CVE-2026-93467

CVE-2026-93467 is an insecure deserialization flaw in OAKlouds by HGiga. Unauthenticated attackers can send crafted data to trigger arbitrary code execution on the server, allowing full compromise of the affected services.

View analysis

critical

CVE-2026-17086

The ShortPixel Image Optimizer plugin for WordPress contains a PHP Object Injection vulnerability in versions up to and including 6.5.5. It arises from the unsafe deserialization of untrusted input accessible to authenticated users with author-level privileges and above. While no native POP chain exists in the plugin itself, the presence of a compatible gadget chain from another theme or plugin could enable arbitrary file deletion, data retrieval, or code execution.

View analysis

critical

CVE-2026-81810

The All-in-One WP Migration and Backup plugin for WordPress fails to enforce proper capability checks on multiple AJAX actions. This oversight allows users with export privileges to import arbitrary site archives and escalate privileges to administrator under specific misconfigurations.

View analysis

critical

CVE-2026-85123

The Easy Form Builder plugin for WordPress fails to properly validate submitted values against stored configurations for certain form types. This oversight allows unauthenticated attackers to create unauthorized WordPress accounts on target sites where user registration has been explicitly disabled by the administrator. The flaw undermines core site access controls and exposes the installation to potential administrative takeover.

View analysis