Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
Published: 2026-07-13
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Sergey AIWU ai-copilot-content-generator for WordPress accepts user input without proper sanitization, enabling attackers to inject arbitrary SQL through blind injection. The flaw is a classic input validation weakness, classified as CWE-89, and may allow unauthorized reading of sensitive data or alteration of database contents, thereby compromising confidentiality and integrity of the application.

Affected Systems

All WordPress sites that have installed Sergey AIWU ai-copilot-content-generator version 1.5.4 or earlier are affected. The vendor is Sergey and the product is AIWU. No other WordPress core versions are specified as impacted.

Risk and Exploitability

The CVSS score of 9.3 classifies this issue as critical, but the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote actor sending specially crafted requests—such as via HTTP GET or POST—to unfiltered plugin endpoints, exploiting blind SQL injection to infer database schemas, exfiltrate data, or manipulate records without immediate detection.

Generated by OpenCVE AI on August 1, 2026 at 10:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the AIWU ai-copilot-content-generator plugin to the latest version that includes the SQL injection fix.
  • If an upgrade is not possible, uninstall or delete the plugin from the WordPress installation to remove the vulnerable code.
  • Apply least‑privilege database practices by limiting the WordPress database user to only the permissions required (e.g., SELECT, INSERT, UPDATE) and avoid granting ALTER or DROP rights therefore reducing the potential impact of an injection exploit.

Generated by OpenCVE AI on August 1, 2026 at 10:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Sergey
Sergey aiwu
Wordpress
Wordpress wordpress
Vendors & Products Sergey
Sergey aiwu
Wordpress
Wordpress wordpress

Mon, 13 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
Title WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Sergey Aiwu
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-13T13:15:13.545Z

Reserved: 2026-07-05T21:27:29.080Z

Link: CVE-2026-59515

cve-icon Vulnrichment

Updated: 2026-07-13T13:15:10.792Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:30:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')