PT-2026-26850 · WordPress · Wordpress+1

Ronnachai Chaipha + 1 · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-3334

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CMS Commander plugin for WordPress versions prior to 2.289

Description The CMS Commander plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation. Specifically, the or blogname, or blogdescription, and or admin email parameters are not adequately sanitized, allowing authenticated attackers with CMS Commander API key access to inject malicious SQL queries into existing database queries during the restore workflow. This could lead to the extraction of sensitive information from the database.

Recommendations Update the CMS Commander plugin to version 2.289 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-3334

Produtos afetados

Cms Commander

Wordpress

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/0311b546-01a4-4be8-97f3-6df6cd79c3fe?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1639 · Nota
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1366 · Nota
• https://twitter.com/TheHackerWire/status/2035446428970123325 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035237318588854423 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2035215699279323519 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3334 · Nota de Segurança