The CubeWP Framework WordPress plugin before version 1.1.31 contains an improperly sanitized input that is used in a database query through the cubewp_remove_relation AJAX action. Because the plugin fails to escape the parameter and omits a capability check, an attacker with Subscriber-level access or higher can inject arbitrary SQL. This flaw can lead to unauthorized reading, modification or deletion of data, thereby compromising the confidentiality, integrity and availability of the site’s database. The weakness corresponds to CWE‑89.

The vulnerability affects all installations of CubeWP Framework older than 1.1.31. Only users who can access the plugin’s AJAX endpoint – namely those with Subscriber role or higher – can exploit the flaw. No specific sub‑versions are listed beyond the general cut‑off.

Without a publicly available EPSS score the exact likelihood of exploitation is unknown, but the exploitation path is straightforward: an authenticated user sends a crafted request to the cubewp_remove_relation action, and the unvalidated parameter is interpolated directly into a SQL statement. Because the action accepts any Subscriber or above, privilege escalation is not needed. The exploit can therefore be attempted by a typical content contributor or a compromised subscriber account. The vulnerability is not listed in CISA’s KEV catalog, yet its potential to damage the database demands immediate attention.