CVE-2026-94115 in Easy Pricing Tables Plugin
Summary
by MITRE • 09/30/2026
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within Easy Pricing Tables versions 4.1.2 and earlier represents a critical security flaw classified as an injection attack, specifically targeting the backend database through unsanitized user input. This type of weakness is formally categorized under CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command. The root cause lies in the application's failure to properly validate or sanitize data submitted by users with contributor-level permissions before it is incorporated into dynamic SQL queries executed against the database server. In a typical WordPress environment, contributors are intended to have limited privileges, such as creating and editing their own posts, but this vulnerability allows them to bypass those restrictions due to insufficient access controls on specific plugin endpoints or functions that handle pricing table data.
From an operational perspective, this flaw enables authenticated attackers with low-privilege accounts to manipulate the application's database structure or content. By injecting malicious SQL code through input fields associated with pricing tables, such as titles, descriptions, or configuration parameters, an attacker can execute arbitrary commands on the underlying MySQL or MariaDB instance. The impact of this exploitation is severe and multifaceted. It allows for unauthorized data access, where sensitive information including user credentials, personal identifiable information stored in other parts of the WordPress database, or proprietary business logic contained within pricing configurations can be exfiltrated. Furthermore, attackers may modify existing records to deface websites or alter pricing structures, leading to significant reputational damage and potential financial loss if e-commerce functionality is involved. In more advanced scenarios, depending on the database configuration and privileges granted to the web application's database user, this vulnerability could potentially lead to remote code execution by writing malicious files to the server filesystem via SQL commands like INTO OUTFILE or LOAD_FILE.
The exploitation of this vulnerability aligns with several tactics defined in the MITRE ATT&CK framework for enterprise security. It falls under the Initial Access and Execution techniques where an attacker leverages valid credentials obtained through phishing, credential stuffing, or other means to gain a foothold within the system. Once authenticated as a contributor, the attacker utilizes SQL injection (T1190) to interact directly with the database backend. This interaction facilitates Data Exfiltration (T1530), allowing the theft of sensitive data without triggering typical intrusion detection systems that monitor network traffic rather than application-layer logic errors. The lack of proper input validation means that standard web application firewalls may not immediately detect these attacks if they are crafted to bypass basic signature-based rules, making this a persistent threat vector for sites running outdated versions of popular plugins with known flaws.
Mitigation strategies must focus on immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the Easy Pricing Tables plugin to version 4.1.3 or later, where developers have implemented proper input sanitization and output escaping mechanisms using WordPress database API functions such as $wpdb->prepare(). This ensures that all user-supplied data is treated strictly as literal values rather than executable code segments. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations include restricting contributor-level access if not absolutely necessary for business operations or implementing a Web Application Firewall (WAF) with rules specifically tuned to detect SQL injection patterns in POST requests related to the plugin's endpoints. Additionally, regular security audits and penetration testing should be conducted on custom code and third-party plugins to identify similar vulnerabilities before they can be exploited by malicious actors. Maintaining strict version control policies for all WordPress components is essential to prevent exposure to known CVEs that have already been patched in newer releases.