PT-2026-26850 · Thoefter · Cms Commander – Manage Multiple Sites

Ronnachai Chaipha + 1 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3334

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or blogname', 'or blogdescription', and 'or admin email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers, with CMS Commander API key access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3334

Affected Products

Cms Commander – Manage Multiple Sites

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-3334 · Security Note
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1366 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0311b546-01a4-4be8-97f3-6df6cd79c3fe?source=cve · Note
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1639 · Note