Description
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
Published: 2026-06-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an injection flaw in the uid parameter of the BBS e‑Franchise WordPress plugin that allows unauthenticated attackers to inject arbitrary SQL code, enabling them to read sensitive data such as user records and taxonomy terms from the WordPress database. The flaw is a classic SQL injection weakness (CWE‑89).

Affected Systems

The affected product is the bbsetheme BBS e‑Franchise plugin for WordPress, currently at version 1.1.1. Any WordPress site that uses this plugin’s shortcode on publicly accessible pages is at risk.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability represents a high severity condition that can be exploited without authentication. EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not listed in CISA KEV. An attacker can craft a request containing a UNION‑based injection payload to the uid parameter and execute arbitrary SQL queries against the database without needing prior credentials.

Generated by OpenCVE AI on June 18, 2026 at 01:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BBS e‑Franchise plugin to the latest version or to a release where the SQL injection in the uid parameter is fixed.
  • If the plugin is not required, deactivate and uninstall it from the WordPress installation.
  • Implement web application firewall rules that detect and block UNION‑based SQL injection attempts targeting the uid parameter.

Generated by OpenCVE AI on June 18, 2026 at 01:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Bbsetheme
Bbsetheme bbs E-franchise
Wordpress
Wordpress wordpress
Vendors & Products Bbsetheme
Bbsetheme bbs E-franchise
Wordpress
Wordpress wordpress

Mon, 15 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 14:00:00 +0000

Type Values Removed Values Added
Description BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
Title BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Bbsetheme Bbs E-franchise
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-06-15T15:12:49.919Z

Reserved: 2026-06-15T11:39:35.524Z

Link: CVE-2016-20072

cve-icon Vulnrichment

Updated: 2026-06-15T15:12:46.686Z

cve-icon NVD

Status : Deferred

Published: 2026-06-15T14:16:30.377

Modified: 2026-06-15T20:50:47.973

Link: CVE-2016-20072

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:09:27Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')