PT-2026-42102 · WordPress · Boost

Os + 1 · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-9010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Boost plugin for WordPress versions prior to 2.0.4

Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that cause the database to wait for a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database via the 'current url' and user name parameters.

Recommendations Update the plugin to version 2.0.4 or later. As a temporary workaround, restrict access to the parameters 'current url' and user name to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-9010

Affected Products

Boost

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9010 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1cac2397-bb38-40d6-b90d-68e3ea136267?source=cve · Note
• https://t.me/CVEtracker/54347 · Telegram Post
• https://twitter.com/CVEnew/status/2056994208054116518 · Twitter Post
• https://pixelyoursite.com/boost-plugin · Note