{"id":"CVE-2026-82568","kind":"vulnerability","aliases":["CVE-2026-82568"],"related":[],"title":"Give Peer-to-Peer WordPress plugin: time-based SQL injection via sort parameter","description":"The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution.","summary":"The Give Peer-to-Peer WordPress plugin lets unauthenticated visitors inject SQL through the 'sort' parameter, in all versions up to and including 2.9.3. An attacker can read sensitive data from the site's database, and the sources say it can be chained with CVE-2026-82663 to reach remote code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["give","package","self-hosted","wordpress"],"not_affected_if":["plugin-above-2.9.3","plugin-not-installed"],"how_to_check":"- Check the installed version of the Give Peer-to-Peer plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/`\n- Confirm whether at least one Peer-to-Peer campaign exists, since the sources say exploitation requires one","fix":"- Move the Give Peer-to-Peer plugin to a version newer than `2.9.3`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-15T10:16:54+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","triaged_at":"2026-11-15T10:35:25+00:00","updated_at":"2026-11-15T10:35:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T10:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Give Peer-to-Peer plugin to a version newer than `2.9.3`; the sources do not name the exact fixed version","reach":"internet","title":"Give Peer-to-Peer WordPress plugin: time-based SQL injection via sort parameter","impact":"high","summary":"The Give Peer-to-Peer WordPress plugin lets unauthenticated visitors inject SQL through the 'sort' parameter, in all versions up to and including 2.9.3. An attacker can read sensitive data from the site's database, and the sources say it can be chained with CVE-2026-82663 to reach remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","give","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads database contents, and chaining may reach code execution","analyst_note":"Find the exact fixed version of the Give Peer-to-Peer plugin and check the linked CVE-2026-82663 for chaining details; no product ranges were supplied.","how_to_check":"- Check the installed version of the Give Peer-to-Peer plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/`\n- Confirm whether at least one Peer-to-Peer campaign exists, since the sources say exploitation requires one","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.9.3"],"who_is_affected":"Sites running the Give Peer-to-Peer plugin at version 2.9.3 or earlier that have at least one Peer-to-Peer campaign. The sources do not say whether the flaw is reachable on sites without a campaign, and the sources do not describe a configuration that avoids it beyond that. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000817,"input_tokens":4679,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A,74B,177C '-82568':18A,21A '-82663':75B,178C '2.9.3':52B,109C 'achiev':180C 'addit':138C 'alreadi':142C 'append':137C 'attack':54B,135C 'base':10A,95C 'campaign':169C 'chain':71B 'code':79B,183C 'combin':174C 'cve':16A,19A,73B,176C 'data':58B 'databas':63B,155C 'due':110C 'escap':113C 'execut':80B,184C 'exist':126C,143C,160C 'exploit':157C 'extract':150C 'give':1A,22B,29B,82C 'host':26B 'includ':51B,108C 'inform':152C 'inject':12A,39B,97C 'insuffici':112C 'lack':120C 'least':163C 'let':36B 'make':130C 'one':164C 'packag':23B 'paramet':15A,44B,101C,118C 'peer':3A,5A,31B,33B,84C,86C,166C,168C 'peer-to-p':2A,30B,83C,165C 'plugin':7A,35B,87C 'possibl':132C 'prepar':123C 'queri':128C,140C,144C 'reach':77B 'read':56B 'remot':78B,182C 'requir':158C 'say':67B 'self':25B 'self-host':24B 'sensit':57B,151C 'site':61B 'sort':14A,43B,100C 'sourc':66B 'sql':11A,40B,96C,127C,139C 'success':156C 'suffici':122C 'suppli':117C 'time':9A,94C 'time-bas':8A,93C 'unauthent':37B,134C,181C 'use':148C 'user':116C 'version':47B,104C 'via':13A,98C 'visitor':38B 'vulner':91C,171C 'wordpress':6A,27B,34B,89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Give Peer-to-Peer plugin at version 2.9.3 or earlier that have at least one Peer-to-Peer campaign. The sources do not say whether the flaw is reachable on sites without a campaign, and the sources do not describe a configuration that avoids it beyond that. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["give","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':17A,20A '-82568':18A,21A 'base':10A 'cve':16A,19A 'give':1A 'inject':12A 'paramet':15A 'peer':3A,5A 'peer-to-p':2A 'plugin':7A 'sort':14A 'sql':11A 'time':9A 'time-bas':8A 'via':13A 'wordpress':6A","search_b":"'-2026':74B '-82663':75B '2.9.3':52B 'attack':54B 'chain':71B 'code':79B 'cve':73B 'data':58B 'databas':63B 'execut':80B 'give':22B,29B 'host':26B 'includ':51B 'inject':39B 'let':36B 'packag':23B 'paramet':44B 'peer':31B,33B 'peer-to-p':30B 'plugin':35B 'reach':77B 'read':56B 'remot':78B 'say':67B 'self':25B 'self-host':24B 'sensit':57B 'site':61B 'sort':43B 'sourc':66B 'sql':40B 'unauthent':37B 'version':47B 'visitor':38B 'wordpress':27B,34B","search_c":"'-2026':177C '-82663':178C '2.9.3':109C 'achiev':180C 'addit':138C 'alreadi':142C 'append':137C 'attack':135C 'base':95C 'campaign':169C 'code':183C 'combin':174C 'cve':176C 'databas':155C 'due':110C 'escap':113C 'execut':184C 'exist':126C,143C,160C 'exploit':157C 'extract':150C 'give':82C 'includ':108C 'inform':152C 'inject':97C 'insuffici':112C 'lack':120C 'least':163C 'make':130C 'one':164C 'paramet':101C,118C 'peer':84C,86C,166C,168C 'peer-to-p':83C,165C 'plugin':87C 'possibl':132C 'prepar':123C 'queri':128C,140C,144C 'remot':182C 'requir':158C 'sensit':151C 'sort':100C 'sql':96C,127C,139C 'success':156C 'suffici':122C 'suppli':117C 'time':94C 'time-bas':93C 'unauthent':134C,181C 'use':148C 'user':116C 'version':104C 'via':98C 'vulner':91C,171C 'wordpress':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T10:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82568","severity":null,"published_at":"2026-11-15T10:16:54+00:00","modified_at":"2026-11-15T10:16:54+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","fetched_at":"2026-11-15T10:34:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}