PT-2026-26830 · WordPress · Mylinksdump

San6051 · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-2279

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions myLinksDump plugin for WordPress versions through 1.6

Description The myLinksDump plugin for WordPress is susceptible to SQL Injection through the sort by and sort order parameters. This is due to inadequate input sanitization and insufficient SQL query preparation. An authenticated attacker with administrator-level access or higher can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The vulnerable parameters are sort by and sort order.

Recommendations Update the myLinksDump plugin to a version newer than 1.6.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-2279

Produtos afetados

Mylinksdump

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2279 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L414 · Nota
• https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L423 · Nota
• https://twitter.com/CVEnew/status/2035237319742276005 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L423 · Nota
• https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L414 · Nota