CVE-2026-91074 in BSK PDF Manager Plugin
Summary
by MITRE • 10/17/2026
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified within BSK PDF Manager versions through 3.8.1 represents a critical security flaw rooted in insufficient input validation and output encoding mechanisms. Specifically, the plugin fails to properly sanitize or escape user-supplied parameters prior to their incorporation into Structured Query Language statements executed against the underlying database management system. This architectural oversight creates an avenue for SQL injection attacks, which are among the most dangerous web application vulnerabilities due to their potential for complete data compromise and remote code execution in certain configurations. The flaw is not present in all contexts but is specifically triggered when parameters passed through the plugin's interface are processed without adequate protective measures such as prepared statements or rigorous type checking before being concatenated into SQL queries.
The operational impact of this vulnerability is severe, particularly given its accessibility to authenticated users with contributor-level access and above. While many vulnerabilities require administrative privileges to exploit, allowing lower-privileged accounts like contributors to execute database commands significantly lowers the barrier for attack initiation. An attacker leveraging these credentials can manipulate the structure of SQL queries sent to the database server. By injecting malicious syntax, an adversary can bypass authentication checks, modify existing records, or extract sensitive information stored within the WordPress database. The most immediate and damaging consequence is the ability to read arbitrary data from the database, including administrator password hashes. Since WordPress typically stores these hashes using strong hashing algorithms like bcrypt, obtaining them allows for offline brute-force attacks where attackers attempt to reverse-engineer the plaintext passwords without triggering account lockouts or alerts on the live site.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The failure to sanitize input corresponds directly to weaknesses identified in common weakness enumerations regarding data validation and encoding. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework for enterprise security, this exploit falls under techniques associated with Credential Access via Database Dumping or Data Staged Exfiltration if combined with other post-exploitation steps. The ability of contributor-level users to perform these actions highlights a privilege escalation risk where lower-tier accounts are granted excessive capabilities that should be restricted to higher-privileged roles such as editors or administrators, violating the principle of least privilege essential for secure system design.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade BSK PDF Manager to a version later than 3.8.1 where this specific sanitization issue has been resolved by the developers through proper implementation of parameterized queries or prepared statements, which inherently separate SQL logic from data inputs. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting user roles that have access to the plugin's functionality to only those who absolutely require it, thereby reducing the attack surface. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests before they reach the application logic. Regular security audits and code reviews focusing on database interaction layers are also recommended to prevent similar vulnerabilities from being introduced during future development cycles.