{"id":"CVE-2026-121769","kind":"vulnerability","aliases":["CVE-2026-121769"],"related":[],"title":"WordPress phpBB integration plugin: SQL injection through version 3.1.9","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.","summary":"The WP w3all phpBB integration plugin for WordPress, by axew3.com, fails to neutralize special characters in SQL commands. An attacker can inject SQL to read or change data in the site's database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-w3all-phpbb-integration","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","phpbb","wordpress","wp-w3all-phpbb-integration"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the version of wp-w3all-phpbb-integration in WordPress admin > Plugins; versions up to and including 3.1.9 are affected per the CVE description\n- The plugin changelog shows 3.2.0 and later switched queries to prepared statements; the changelog does not name this CVE, so treat 3.2.4 (current stable) as the safe target","fix":"Update to the latest release (3.2.4 at time of reading); 3.2.0+ moved queries to prepared statements but the vendor does not tie this to the CVE. Exact fixed version unconfirmed.","status":"open","published_at":"2026-11-09T19:16:46+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:33+00:00","updated_at":"2026-11-09T19:36:00+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T19:29:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress phpBB integration plugin: SQL injection through version 3.1.9","impact":"high","summary":"The WP w3all phpBB integration plugin for WordPress, by axew3.com, fails to neutralize special characters in SQL commands. An attacker can inject SQL to read or change data in the site's database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-w3all-phpbb-integration","phpbb"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or alters the WordPress database contents","analyst_note":"Confirm the fixed version and whether authentication is required, using the NVD entry and the plugin's WordPress.org or vendor changelog.","how_to_check":"- Check whether the `wp-w3all-phpbb-integration` plugin is installed and its version in the WordPress admin Plugins screen\n- Treat versions up to and including `3.1.9` as affected, per the description","plain_action":"","product_name":"wp-w3all-phpbb-integration","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WordPress with the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration) at version 3.1.9 or earlier are exposed. Sites without the plugin are not affected. The sources do not say whether a non-default setting is required.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4561,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether authentication is required, using the NVD entry and the plugin's WordPress.org or vendor changelog.","search":"'-121769':12A,15A '-2026':11A,14A '3.1.9':9A,96C 'affect':89C 'allow':85C 'attack':48B 'axew3.com':38B,76C 'chang':55B 'charact':43B 'command':46B,71C 'cve':10A,13A 'data':56B 'databas':61B 'element':66C 'fail':39B 'improp':62C 'inject':6A,50B,73C 'injection.this':87C 'integr':3A,28B,33B,84C 'integration':20A 'issu':88C 'n/a':94C 'neutral':41B,63C 'phpbb':2A,19A,22B,27B,32B,79C,83C,92C 'plugin':4A,34B 'read':53B 'site':59B 'special':42B,65C 'sql':5A,45B,51B,70C,72C,86C 'use':67C 'version':8A 'vulner':74C 'w3all':18A,26B,31B,78C,82C,91C 'wordpress':1A,23B,36B 'wp':17A,25B,30B,77C,81C,90C 'wp-w3all-phpbb-integration':16A,24B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration) at version 3.1.9 or earlier are exposed. Sites without the plugin are not affected. The sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpw3allphpbbintegration"],"ptokens":["integration","phpbb","w3all","wp"],"labels":["high","other","phpbb","vendor","wordpress","wpw3allphpbbintegration"],"campaign_type":null,"search_a":"'-121769':12A,15A '-2026':11A,14A '3.1.9':9A 'cve':10A,13A 'inject':6A 'integr':3A 'integration':20A 'phpbb':2A,19A 'plugin':4A 'sql':5A 'version':8A 'w3all':18A 'wordpress':1A 'wp':17A 'wp-w3all-phpbb-integration':16A","search_b":"'attack':48B 'axew3.com':38B 'chang':55B 'charact':43B 'command':46B 'data':56B 'databas':61B 'fail':39B 'inject':50B 'integr':28B,33B 'neutral':41B 'phpbb':22B,27B,32B 'plugin':34B 'read':53B 'site':59B 'special':42B 'sql':45B,51B 'w3all':26B,31B 'wordpress':23B,36B 'wp':25B,30B 'wp-w3all-phpbb-integration':24B","search_c":"'3.1.9':96C 'affect':89C 'allow':85C 'axew3.com':76C 'command':71C 'element':66C 'improp':62C 'inject':73C 'injection.this':87C 'integr':84C 'issu':88C 'n/a':94C 'neutral':63C 'phpbb':79C,83C,92C 'special':65C 'sql':70C,72C,86C 'use':67C 'vulner':74C 'w3all':78C,82C,91C 'wp':77C,81C,90C 'wp-w3all-phpbb-integration':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121769","severity":null,"published_at":"2026-11-09T19:16:46+00:00","modified_at":"2026-11-09T19:16:46+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121769:2335","url":"https://wordpress.org/plugins/wp-w3all-phpbb-integration/","severity":null,"published_at":"2026-11-09T19:36:00+00:00","modified_at":"2026-11-09T19:36:00+00:00","first_seen_at":"2026-11-09T19:36:00+00:00","fetched_at":"2026-11-09T19:36:00+00:00","note":"NVD page unreadable via WebFetch (JS) and web-cli out of Exa credits. WordPress.org changelog: 3.2.0 (Nov 3 2026) moved all queries to prepared statements, 3.2.1 removed esc_sql and says it fixes other query security issues; current stable 3.2.4. Changelog never names this CVE, so the fixed version is not confirmed and auth requirement is unknown. Nothing verified. Needs the NVD CVSS vector / CNA advisory (Wordfence?) to settle.","cites":["https://wordpress.org/plugins/wp-w3all-phpbb-integration/"]}],"documents":[{"id":109491,"url":"https://wordpress.org/plugins/wp-w3all-phpbb-integration/","title":"WP w3all phpBB integration - WordPress.org plugin page and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}