CVE-2026-96826: WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection.
This issue affects W4 Post List: from n/a through 3.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress W4 Post List pluginto a version that resolves this vulnerability.Fixed in 3.0.7
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs high privileges. Exploitation is network-accessible, requires no user interaction, and has low attack complexity once the required privileges are available.
What impact could successful exploitation have?
Successful exploitation may expose confidential information through blind SQL injection and may cause a limited availability impact. The CVSS vector indicates no integrity impact, while the changed scope suggests effects may extend beyond the vulnerable component.
Which installations should be considered affected?
W4 Post List versions through 3.0.6 are identified as affected. The available information does not specify a fixed version.