PT-2026-67261 · WordPress · Cubewp Framework
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
CubeWP Framework versions prior to 1.1.31
Description
Authenticated users with subscriber-level access and above can perform SQL Injection. The issue exists in the
cubewp remove relation() AJAX function due to insufficient input sanitization of the relation id parameter. The function uses wp unslash(), which removes backslash escaping from POST data, and then interpolates the value directly into a raw SQL query without using $wpdb->prepare(). While sanitize text field() is applied, it does not provide protection against SQL injection, allowing attackers to append additional SQL queries to the existing one.Recommendations
Update CubeWP Framework to a version newer than 1.1.30.
As a temporary workaround, restrict access to the
cubewp remove relation() function for users with subscriber-level permissions.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cubewp Framework