Live › vulnerability › CVE-2026-91074
Go to dashboardThe BSK PDF Manager WordPress plugin through 3.8.1 passes an unsanitised parameter into a SQL statement. An authenticated user with contributor-level access or above can use it to read sensitive data, such as administrator password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the BSK PDF Manager plugin at version 3.8.1 or earlier are exposed. The risk requires a logged-in account with contributor role or higher, so sites with only subscriber or anonymous visitors are less exposed. Sites that do not have the plugin installed can skip it.
No product ranges from the sources yet.
wp plugin get bsk-pdf-manager --field=version (slug assumed; confirm it)wp-content/plugins/ and read its version header3.8.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-91074")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.