WordPress Plugin Vulnerabilities

Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

Description

The plugin does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.

Proof of Concept

Affects Plugins

Plugin icon
library-management-system
Fixed in 3.6.7

References

CVE
CVE-2026-18666

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
7a9b3fff-f454-4764-ad60-0b273781f7b4

Timeline

Publicly Published
2026-08-05 (about 5 days ago)
Added
2026-08-05 (about 4 days ago)
Last Updated
2026-08-07 (about 2 days ago)

Other

Published
Title
Published
2025-06-05
Title
WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection
Published
2025-04-29
Title
tagDiv Opt-In Builder < 1.7.1 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter
Published
2023-01-12
Title
Easy Digital Downloads 3.1.0.2 & 3.1.0.3 - Unauthenticated SQLi
Published
2022-02-01
Title
Conversios.io < 4.6.2 - Subscriber+ SQL Injection
Published
2025-07-01
Title
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection