CVE-2026-65546: WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

Published Aug 6, 2026

Updated

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

Affected Software

1 affected component

Qode Interactive Qode Tours (WordPress plugin)<=3.1.3.1

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Qode Tours plugin to a version that resolves this vulnerability.
Fixed in 3.1.3.1
Compensating control
Use a compensating control such as restricting access to the affected WordPress plugin endpoints until the Qode Tours plugin is upgraded beyond versions <= 3.1.3.1.

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

CVE-2026-65546 has a critical severity rating of 9.3.

To fix CVE-2026-65546, you should update the Qode Tours plugin to version 3.1.3.2 or later.

CVE-2026-65546 is an unauthenticated SQL Injection vulnerability.

Qode Tours versions up to and including 3.1.3.1 are affected by CVE-2026-65546.

No, CVE-2026-65546 can be exploited without user authentication.