Live › vulnerability › CVE-2026-110651
Go to dashboardThe Swift Performance Lite WordPress plugin before 2.3.7.4 does not sanitize a value before using it in a SQL statement. An authenticated user with the author role or higher can inject SQL to read or change database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running the Swift Performance Lite plugin before 2.3.7.4 are exposed. The attacker must hold an author-role account or higher, so sites that only allow trusted administrators to log in carry less risk. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get swift-performance-lite --field=version2.3.7.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-110651")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.