CVE-2026-84113: Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

Q: Which users can exploit this issue?

Exploitation requires a high-privilege user, such as a WordPress administrator. The available information does not indicate that unauthenticated or lower-privilege users can exploit it.

Q: Which plugin versions are affected?

Quentn WP versions before 1.2.15 are affected. Upgrading to version 1.2.15 or later addresses the affected version range.

Q: What inputs are involved in exploitation?

The SQL injection is associated with the orderby and order parameters. An authenticated high-privilege user can use improperly sanitized and escaped input in these parameters to affect an SQL query.

Published Sep 9, 2026

Updated

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.

Affected Software

1 affected component

Quentn WP WordPress plugin<1.2.15

Event History

Sep 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Exploitation requires a high-privilege user, such as a WordPress administrator. The available information does not indicate that unauthenticated or lower-privilege users can exploit it.

Which plugin versions are affected?

Quentn WP versions before 1.2.15 are affected. Upgrading to version 1.2.15 or later addresses the affected version range.

What inputs are involved in exploitation?

The SQL injection is associated with the orderby and order parameters. An authenticated high-privilege user can use improperly sanitized and escaped input in these parameters to affect an SQL query.