CVE-2026-84068: Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

Q: Who can exploit this issue?

An attacker does not need to authenticate. Any deployment running a vulnerable Quentn WP plugin version before 1.2.15 is potentially exposed if the affected request path is reachable.

Q: What access does an attacker gain through successful exploitation?

The SQL injection can allow extraction of arbitrary data from the WordPress database. The provided information does not establish database modification, code execution, or server-level access.

Q: Which versions need remediation?

Quentn WP versions 1.2.13 and 1.2.14 are identified as affected, and the issue is described as affecting versions before 1.2.15. Update to version 1.2.15 or later.

Published Sep 9, 2026

Updated

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

Affected Software

1 affected component

WordPress plugin Quentn WP<1.2.15

Event History

Sep 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker does not need to authenticate. Any deployment running a vulnerable Quentn WP plugin version before 1.2.15 is potentially exposed if the affected request path is reachable.

What access does an attacker gain through successful exploitation?

The SQL injection can allow extraction of arbitrary data from the WordPress database. The provided information does not establish database modification, code execution, or server-level access.

Which versions need remediation?

Quentn WP versions 1.2.13 and 1.2.14 are identified as affected, and the issue is described as affecting versions before 1.2.15. Update to version 1.2.15 or later.