PT-2026-31098 · WordPress · Attendance Manager

Maurice Fielenbach · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-3781

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Attendance Manager plugin for WordPress versions up to and including 0.6.2

Description The Attendance Manager plugin for WordPress is susceptible to SQL Injection through the attmgr off parameter. This is a result of inadequate input sanitization and insufficient query preparation, potentially allowing authenticated attackers with Subscriber-level access or higher to inject additional SQL queries and extract sensitive database information.

Recommendations Update the Attendance Manager plugin to a version newer than 0.6.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3781

Affected Products

Attendance Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3781 · Security Note
• https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L148 · Note
• https://twitter.com/CVEnew/status/2043561058426671331 · Twitter Post
• https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L142 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve · Note