WordPress Plugin Vulnerabilities

CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

Description

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
cubewp-framework
Fixed in 1.1.31

References

CVE
CVE-2026-17017

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
50d95281-7b3f-4d5a-bf04-8e7bd88f4b55

Timeline

Publicly Published
2026-08-04 (about 26 days ago)
Added
2026-08-04 (about 25 days ago)
Last Updated
2026-08-27 (about 2 days ago)

Other

Published
Title
Published
2023-12-28
Title
Page Generator < 1.7.2 - Authenticated(Administrator+) SQL Injection
Published
2017-04-10
Title
Calendar by WD <= 1.5.51 - Authenticated Blind SQL Injection
Published
2021-06-29
Title
Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection
Published
2026-04-15
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.7.3 - Authenticated (Store vendor+) SQL Injection
Published
2025-11-20
Title
WP Directory Kit < 1.4.4 - Unauthenticated SQL Injection via select_2_ajax() Function