CVE-2026-84047: Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
Published Sep 12, 2026
·Updated
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Affected Software
1 affected component
WordPress Album Cover Finder<=0.7.0
Event History
Sep 12, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker does not need to authenticate. Any party able to send requests to a site running the affected plugin may be able to attempt SQL injection through the vulnerable parameter.
2
Which plugin versions are affected?
The issue affects Album Cover Finder versions through 0.7.0. The provided information does not identify a fixed version.
3
What input is involved in exploitation?
The vulnerable input is the and_action parameter. It is used in a SQL query without adequate sanitization and escaping.