PT-2026-26830 · WordPress · Mylinksdump

San6051 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-2279

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions myLinksDump plugin for WordPress versions through 1.6

Description The myLinksDump plugin for WordPress is susceptible to SQL Injection through the sort by and sort order parameters. This is due to inadequate input sanitization and insufficient SQL query preparation. An authenticated attacker with administrator-level access or higher can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The vulnerable parameters are sort by and sort order.

Recommendations Update the myLinksDump plugin to a version newer than 1.6.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2279

Affected Products

Mylinksdump

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2279 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L414 · Note
• https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L423 · Note
• https://twitter.com/CVEnew/status/2035237319742276005 · Twitter Post
• https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L423 · Note
• https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L414 · Note