rootpwn

critical · CVSS v3 9.3 · EPSS 0.00236

CVE-2026-94388

CVE-2026-94388 exposes a blind SQL injection flaw in halfdata Green Popups, allowing attackers to extract data from the database without vis

Overview

CVE-2026-94388 exposes a blind SQL injection flaw in halfdata Green Popups, allowing attackers to extract data from the database without visible errors. The vulnerability exists in all versions prior to 7.6.3 and can be exploited remotely via crafted input. It is critical due to the potential for full data compromise.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.

Impact

The flaw permits attackers to read, modify, or delete sensitive data, undermining confidentiality, integrity, and availability of the application’s database. Defenders must protect user credentials, financial records, and any stored personal information. The attack surface is broad, affecting all exposed endpoints that accept user input.

Remediation

1. Upgrade to Green Popups version 7.6.3 or later, which contains the fixed input sanitization. 2. Ensure all database interactions use parameterized queries or prepared statements. 3. Restrict database user privileges to the minimum required for application functionality. 4. Enable logging and monitor for anomalous SQL activity. 5. Conduct regular vulnerability scans and penetration tests to confirm remediation.

Risk context

The CVE is rated critical with a CVSS v3 score of 9.3, indicating a high likelihood of exploitation and severe impact. Although the EPSS score is low (0.00236), the critical severity warrants immediate attention and patching to prevent potential data breaches.

Affected products

  • halfdata Green Popups

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.3
CVSS v4
—
EPSS
0.00236

sql-injection blind critical database web-application vulnerability EPSS CVE-2026-94388

← All CVEs

Related CVEs

critical

CVE-2026-104932

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

View analysis

critical

CVE-2026-85659

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

View analysis

critical

CVE-2026-89079

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

View analysis

critical

CVE-2026-104730

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.

View analysis