CVE-2026-61966 in Basic Plugin
Summary
by MITRE • 08/13/2026
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability identified as subscriber sql injection in WPJAM Basic plugin versions up to 7.0.1 represents a critical security flaw that allows unauthorized users to execute malicious sql commands against the affected wordpress installation. This vulnerability stems from improper input validation and sanitization within the plugin's handling of subscriber data, specifically when processing user requests through the wpjam_basic_subscriber endpoint.
The technical implementation of this flaw occurs when the plugin fails to adequately sanitize user-supplied parameters before incorporating them into sql queries. Attackers can exploit this weakness by crafting malicious input that gets directly embedded into database queries without proper escaping or parameterization. The vulnerability specifically affects the subscriber management functionality where user data is processed through unprotected api endpoints, creating a path for sql injection attacks that can be leveraged to extract sensitive information from the database.
From an operational impact perspective, this vulnerability exposes wordpress installations to severe security risks including unauthorized data access, data modification, and potential complete system compromise. An attacker could extract user credentials, subscriber lists, configuration details, and other sensitive information stored in the database. The attack surface is particularly concerning as it targets a widely used plugin with numerous installations, potentially affecting thousands of wordpress sites simultaneously.
This vulnerability aligns with CWE-89 which specifically addresses sql injection flaws in software applications. The flaw demonstrates poor input validation practices and violates fundamental security principles for database interaction. From an attacker perspective, this represents a high-value target within the ATT&CK framework under the initial access and execution phases where adversaries can leverage such vulnerabilities to establish persistent access to systems.
Mitigation strategies should include immediate upgrading to WPJAM Basic version 7.0.2 or later which contains the necessary patches for this vulnerability. Additionally administrators should implement proper input validation at all points where user data is processed, employ prepared statements and parameterized queries, and conduct regular security audits of installed plugins. Network monitoring should be enhanced to detect unusual database access patterns that might indicate exploitation attempts, while also ensuring that only authorized users have access to subscriber management interfaces.