CVE-2026-2283 in User Login History Plugin
Summary
by MITRE • 08/16/2026
The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on multisite installations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The User Login History plugin for WordPress presents a critical SQL injection vulnerability that affects all versions up to and including 2.1.7, specifically targeting multisite installations. This vulnerability stems from inadequate input sanitization practices within the plugin's handling of the 'blog_id' parameter, creating a pathway for malicious exploitation that aligns with CWE-89 SQL Injection weakness classification. The flaw exists in the plugin's database query construction process where user-supplied parameters are not properly escaped or parameterized, allowing attackers to manipulate existing SQL queries through crafted input sequences.
The technical implementation of this vulnerability requires an authenticated attacker possessing Administrator-level privileges or higher to exploit successfully, making it particularly concerning for environments where administrative access might be compromised. The attack vector specifically targets the blog_id parameter which is processed within a SQL query structure that lacks proper prepared statement usage or adequate escaping mechanisms. This creates a condition where additional SQL commands can be injected into existing queries through concatenation of malicious input, effectively enabling attackers to manipulate database operations beyond their intended scope.
Operational impact of this vulnerability extends significantly in environments utilizing WordPress multisite configurations, as the exploitability is explicitly limited to these installations. Attackers can leverage this weakness to extract sensitive information from the database including but not limited to user credentials, administrative access details, and other confidential data stored within the WordPress installation's database schema. The vulnerability allows for arbitrary SQL query execution which can result in complete database compromise, data exfiltration, and potential lateral movement within the affected network infrastructure.
Security mitigations for this vulnerability should prioritize immediate plugin updates to versions that implement proper parameterization of database queries and adequate input validation practices. Organizations should enforce strict access controls and privilege separation to minimize the impact of potential exploitation, while implementing database query monitoring and intrusion detection systems to identify suspicious SQL patterns. The remediation process must include verifying that all user inputs are properly escaped or parameterized before database processing, aligning with best practices outlined in the OWASP Top Ten and ATT&CK framework's credential access techniques. Additionally, network segmentation and regular security audits should be implemented to reduce attack surface and detect potential exploitation attempts within multisite WordPress environments.