CVE-2026-94388

9.3Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-89

Impact

Unauthenticated remote attackers can execute blind SQL injection to extract data from the database. They only need network access to the target WordPress instance.

Root cause

The plugin fails to sanitize user-supplied input before using it in dynamic SQL queries.

Affected systems

halfdata Green Popups before 7.6.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Fix & remediation

Update the Green Popups plugin to version 7.6.3 or later. If updating immediately is not possible, deactivate the plugin until patched.

shell

$ wp plugin update halfdata-green-popups

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.

References

https://patchstack.com/database/wordpress/plugin/halfdata-green-popups/vulnerability/wordpress-green-popups-plugin-7-6-3-sql-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-94388