Live › vulnerability › CVE-2026-61996
MLS On The Fly, a WordPress plugin, versions up to 1.8.1.5 contain an SQL injection flaw reachable by users with subscriber-level accounts. An attacker with such an account can read or change data in the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites running MLS On The Fly at version 1.8.1.5 or older. The flaw needs a subscriber-level account on the site, so sites that allow open registration are more exposed than sites with closed user lists. Sites without this plugin can skip it.
No product ranges from the sources yet.
mls-on-the-fly and its version header.1.8.1.5; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61996")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.