CVE-2026-115607: WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

Q: Which installations are affected?

DXP ToolKit versions through 2.0.1 are affected. The available data does not identify a safe fixed version.

Q: Can this be exploited remotely without credentials or user interaction?

Yes. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact could successful exploitation have?

The supplied CVSS vector indicates high confidentiality impact and low availability impact. It does not indicate an integrity impact.

Published Oct 28, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.

Affected Software

1 affected component

Crowd Favorite DXP ToolKit<=2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress DXP ToolKit to a version that resolves this vulnerability.
Fixed in 2.0.2

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

DXP ToolKit versions through 2.0.1 are affected. The available data does not identify a safe fixed version.

Can this be exploited remotely without credentials or user interaction?

Yes. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact could successful exploitation have?

The supplied CVSS vector indicates high confidentiality impact and low availability impact. It does not indicate an integrity impact.

CVE-2026-115607: WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without credentials or user interaction?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without credentials or user interaction?

What impact could successful exploitation have?