CVE-2026-104389: WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, has low attack complexity, requires low privileges, and does not require user interaction.

Q: What impact is indicated by the published severity metrics?

The published CVSS metrics indicate high confidentiality impact and low availability impact, with no integrity impact indicated. The vector also indicates a scope change.

Published Oct 5, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.

Affected Software

1 affected component

Sirv Sirv WordPress plugin<=8.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Sirv plugin to a version that resolves this vulnerability.
Fixed in 8.2.6

Event History

Oct 5, 2026

CVE Published

via MITRE·08:57 AM

Data Sourced

via MITRE·08:57 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, has low attack complexity, requires low privileges, and does not require user interaction.

What impact is indicated by the published severity metrics?