CVE-2026-121769: WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axew3.com WP w3all phpBB wp-w3all-phpbb-integrationto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and has low attack complexity.
Can this be exploited remotely?
Yes. The attack vector is network-based (AV:N), indicating exploitation can be attempted over the network by an attacker who has the required privileges.
What is the likely impact if exploitation succeeds?
The reported impact includes high confidentiality impact and low availability impact. Integrity impact is listed as none, while the scope is changed (S:C).
Which releases are affected?
The affected range is stated as WP w3all phpBB versions through 3.1.9. No fixed version is provided in the available data.