CVE-2026-91074: BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

Q: Who can exploit this issue?

An authenticated WordPress user with at least Contributor-level access can exploit it. Unauthenticated visitors are not identified as able to exploit it in the available information.

Q: What could an attacker obtain through exploitation?

The SQL injection can be used to read sensitive data from the WordPress database, including administrator password hashes.

Q: Which plugin versions are affected?

BSK PDF Manager versions through 3.8.1 are affected. The provided information does not identify a fixed version or workaround.

Published Oct 17, 2026

Updated

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.

Affected Software

1 affected component

BSK BSK PDF Manager<=3.8.1

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with at least Contributor-level access can exploit it. Unauthenticated visitors are not identified as able to exploit it in the available information.

What could an attacker obtain through exploitation?

The SQL injection can be used to read sensitive data from the WordPress database, including administrator password hashes.

Which plugin versions are affected?

BSK PDF Manager versions through 3.8.1 are affected. The provided information does not identify a fixed version or workaround.

CVE-2026-91074: BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through exploitation?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through exploitation?

Which plugin versions are affected?