WP-W3ALL-PHPBB-INTEGRATION · CVE-2026-121769 · Other
NO FIX YET · SEE WHAT TO DO
The WP w3all phpBB integration plugin for WordPress, by axew3.com, fails to neutralize special characters in SQL commands. An attacker can inject SQL to read or change data in the site's database.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running WordPress with the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration) at version 3.1.9 or earlier are exposed. Sites without the plugin are not affected. The sources do not say whether a non-default setting is required.
Not affected if plugin-not-installed
Who cares phpbb, wordpress, wp-w3all-phpbb-integration
3.2.4 at time of reading); 3.2.0+ moved queries to prepared statements but the vendor does not tie this to the CVEPosts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.