{"id":"CVE-2026-115224","kind":"vulnerability","aliases":["CVE-2026-115224"],"related":[],"title":"Customer Engagement System WordPress plugin: admin SQL injection reads the database","description":"The Customer Engagement System  WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.","summary":"The Customer Engagement System WordPress plugin before 2.0.2 builds the SQL INSERT that saves popup page and category visibility rules by concatenating request-supplied IDs directly into the query. An authenticated administrator can inject arbitrary SQL and read the WordPress database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-2.0.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or with `wp plugin get <plugin-slug> --field=version`; versions below `2.0.2` are affected.","fix":"- Update the Customer Engagement System plugin to `2.0.2` or later.\n- Until updated, restrict administrator accounts to trusted users.","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:24+00:00","updated_at":"2026-10-28T06:32:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Customer Engagement System plugin to `2.0.2` or later.\n- Until updated, restrict administrator accounts to trusted users.","reach":"internet","title":"Customer Engagement System WordPress plugin: admin SQL injection reads the database","impact":"high","summary":"The Customer Engagement System WordPress plugin before 2.0.2 builds the SQL INSERT that saves popup page and category visibility rules by concatenating request-supplied IDs directly into the query. An authenticated administrator can inject arbitrary SQL and read the WordPress database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads the full WordPress database, including user and password hashes.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or with `wp plugin get <plugin-slug> --field=version`; versions below `2.0.2` are affected.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.0.2-or-later"],"who_is_affected":"Sites running the Customer Engagement System WordPress plugin before 2.0.2. Exploitation needs an administrator account, so the risk is mainly for sites with many admins or compromised admin credentials. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3332,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115224':14A,17A '-2026':13A,16A '2.0.2':30B,72C 'admin':6A 'administr':55B,111C 'allow':108C 'arbitrari':58B,114C 'authent':54B,110C 'bind':104C 'build':31B,76C 'cast':107C 'categori':40B,87C 'concaten':44B,90C 'content':119C 'custom':1A,24B,66C 'cve':12A,15A 'databas':11A,64B,123C 'direct':49B,96C 'engag':2A,25B,67C 'id':48B,94C 'inject':8A,57B,113C 'insert':34B,99C 'integ':106C 'packag':18B 'page':38B,85C 'paramet':103C 'plugin':5A,22B,28B,70C 'popup':37B,83C 'queri':52B 'read':9A,61B,117C 'request':46B,92C 'request-suppli':45B,91C 'rule':42B,89C 'safe':75C 'save':36B 'sql':7A,33B,59B,78C,115C 'statement':79C,100C 'store':81C 'suppli':47B,93C 'system':3A,26B,68C 'valu':95C 'visibl':41B,88C 'wordpress':4A,19B,21B,27B,63B,69C,122C 'wordpress-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Customer Engagement System WordPress plugin before 2.0.2. Exploitation needs an administrator account, so the risk is mainly for sites with many admins or compromised admin credentials. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115224","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}