PT-2026-26850 · WordPress · Wordpress+1

Ronnachai Chaipha + 1 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3334

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CMS Commander plugin for WordPress versions prior to 2.289

Description The CMS Commander plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation. Specifically, the or blogname, or blogdescription, and or admin email parameters are not adequately sanitized, allowing authenticated attackers with CMS Commander API key access to inject malicious SQL queries into existing database queries during the restore workflow. This could lead to the extraction of sensitive information from the database.

Recommendations Update the CMS Commander plugin to version 2.289 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3334

Affected Products

Cms Commander

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3334 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0311b546-01a4-4be8-97f3-6df6cd79c3fe?source=cve · Note
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1639 · Note
• https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.288/lib/CMSC/Backup.php#L1366 · Note
• https://twitter.com/TheHackerWire/status/2035446428970123325 · Twitter Post
• https://twitter.com/CVEnew/status/2035237318588854423 · Twitter Post
• https://twitter.com/CveFindCom/status/2035215699279323519 · Twitter Post