PT-2026-26838 · WordPress · Quentn Wp

Nabil Irawan · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-2468

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quentn WP plugin for WordPress versions through 1.2.12

Description The Quentn WP plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and insufficient SQL query preparation. Specifically, the vulnerability resides in the get user access() method and affects the qntn wp access cookie. This allows unauthenticated attackers to inject additional SQL queries, potentially leading to the extraction of sensitive information from the database.

Recommendations Update the Quentn WP plugin to a version later than 1.2.12.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-2468

Produtos afetados

Quentn Wp

Referências · 5

• https://plugins.trac.wordpress.org/browser/quentn-wp/tags/1.2.12/includes/class-quentn-wp-restrict-access.php#L483 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2468 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/quentn-wp/trunk/includes/class-quentn-wp-restrict-access.php#L483 · Nota
• https://twitter.com/CVEnew/status/2035237277883052539 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/653e20ae-f018-41b5-a973-f73fddae70e5?source=cve · Nota