---
id: "CVE-2026-121769"
page: "https://infrastack.ai/live/CVE-2026-121769"
kind: "vulnerability"
aliases: ["CVE-2026-121769"]
title: "WordPress phpBB integration plugin: SQL injection through version 3.1.9"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wp-w3all-phpbb-integration", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "phpbb", "wordpress", "wp-w3all-phpbb-integration"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T19:16:46+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:36:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121769", "first_seen_at": "2026-11-09T19:28:14+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/wp-w3all-phpbb-integration/", "first_seen_at": "2026-11-09T19:36:00+00:00", "cites": ["https://wordpress.org/plugins/wp-w3all-phpbb-integration/"]}]
exploit_sources: []
---

# WordPress phpBB integration plugin: SQL injection through version 3.1.9

Link for people: https://infrastack.ai/live/CVE-2026-121769 (this .md is for agents)

The WP w3all phpBB integration plugin for WordPress, by axew3.com, fails to neutralize special characters in SQL commands. An attacker can inject SQL to read or change data in the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wp-w3all-phpbb-integration affected range not listed fixed no fixed version listed

## How to check

- Check the version of wp-w3all-phpbb-integration in WordPress admin > Plugins; versions up to and including 3.1.9 are affected per the CVE description
- The plugin changelog shows 3.2.0 and later switched queries to prepared statements; the changelog does not name this CVE, so treat 3.2.4 (current stable) as the safe target

## Fix

Update to the latest release (3.2.4 at time of reading); 3.2.0+ moved queries to prepared statements but the vendor does not tie this to the CVE. Exact fixed version unconfirmed.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121769
- 2026-11-09T19:36:00+00:00 analyst https://wordpress.org/plugins/wp-w3all-phpbb-integration/ — NVD page unreadable via WebFetch (JS) and web-cli out of Exa credits. WordPress.org changelog: 3.2.0 (Nov 3 2026) moved all queries to prepared statements, 3.2.1 removed esc_sql and says it fixes other query security issues; current stable 3.2.4. Changelog never names this CVE, so the fixed version is not confirmed and auth requirement is unknown. Nothing verified. Needs the NVD CVSS vector / CNA advisory (Wordfence?) to settle.

## Documents

- [describes] WP w3all phpBB integration - WordPress.org plugin page and changelog https://wordpress.org/plugins/wp-w3all-phpbb-integration/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_