CVE-2026-81420: Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

Q: Who can exploit this issue?

Any remote, unauthenticated user can exploit the vulnerable AJAX action. No login or user interaction is required.

Q: Which deployments are affected?

Tcard WP versions through 1.8.0 are affected. The issue is in an unauthenticated AJAX action, so sites exposing the plugin's normal WordPress AJAX functionality are potentially reachable remotely.

Q: What can an attacker achieve?

An attacker can inject SQL through the group_id parameter. The provided CVSS vector indicates high confidentiality impact, meaning database information may be exposed; integrity and availability impacts are not indicated.

Q: How can I identify potentially affected installations?

Check whether Tcard WP is installed and determine its installed version. Versions 1.8.0 and earlier should be treated as affected.

Published Oct 11, 2026

Updated

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.

Affected Software

1 affected component

Tcard WP<=1.8.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any remote, unauthenticated user can exploit the vulnerable AJAX action. No login or user interaction is required.

Which deployments are affected?

Tcard WP versions through 1.8.0 are affected. The issue is in an unauthenticated AJAX action, so sites exposing the plugin's normal WordPress AJAX functionality are potentially reachable remotely.

What can an attacker achieve?

An attacker can inject SQL through the group_id parameter. The provided CVSS vector indicates high confidentiality impact, meaning database information may be exposed; integrity and availability impacts are not indicated.

How can I identify potentially affected installations?

Check whether Tcard WP is installed and determine its installed version. Versions 1.8.0 and earlier should be treated as affected.

CVE-2026-81420: Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What can an attacker achieve?

How can I identify potentially affected installations?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What can an attacker achieve?

How can I identify potentially affected installations?