Live › vulnerability › CVE-2026-115224
Go to dashboardThe Customer Engagement System WordPress plugin before 2.0.2 builds the SQL INSERT that saves popup page and category visibility rules by concatenating request-supplied IDs directly into the query. An authenticated administrator can inject arbitrary SQL and read the WordPress database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Customer Engagement System WordPress plugin before 2.0.2. Exploitation needs an administrator account, so the risk is mainly for sites with many admins or compromised admin credentials. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version; versions below 2.0.2 are affected.2.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
This page as .md · .json · in your agent: get_signal("CVE-2026-115224")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.