CVE-2026-59515

WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability

Published Jul 13, 2026 CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.

Analysis

Technical impact

Sergey AIWU ai-copilot-content-generator for WordPress accepts user input without proper sanitization, enabling attackers to inject arbitrary SQL through blind injection. The flaw is a classic input validation weakness, classified as CWE-89, and may allow unauthorized reading of sensitive data or alteration of database contents, thereby compromising confidentiality and integrity of the application.

Affected Systems

All WordPress sites that have installed Sergey AIWU ai-copilot-content-generator version 1.5.4 or earlier are affected. The vendor is Sergey and the product is AIWU. No other WordPress core versions are specified as impacted.

Risk and Exploitability

The CVSS score of 9.3 classifies this issue as critical, but the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote actor sending specially crafted requests—such as via HTTP GET or POST—to unfiltered plugin endpoints, exploiting blind SQL injection to infer database schemas, exfiltrate data, or manipulate records without immediate detection.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Sergey

AIWU

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.5.4

No data.

Vendor Product Versions

Sergey

Aiwu

Version	Status	Scheme	Platform
`[0,1.5.4]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the AIWU ai-copilot-content-generator plugin to the latest version that includes the SQL injection fix.
If an upgrade is not possible, uninstall or delete the plugin from the WordPress installation to remove the vulnerable code.
Apply least‑privilege database practices by limiting the WordPress database user to only the permissions required (e.g., SELECT, INSERT, UPDATE) and avoid granting ALTER or DROP rights therefore reducing the potential impact of an injection exploit.

Generated by OpenCVE AI on August 1, 2026 at 10:17 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.400% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-4-sql-injection-vulnerability?_s_id=cve

History

Jul 13, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 1:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sergey Sergey aiwu Wordpress Wordpress wordpress
Vendors & Products		Sergey Sergey aiwu Wordpress Wordpress wordpress

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
Title		WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability
Weaknesses		CWE-89
References		https://patchstack.com/database/Wordpress/Plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-4-sql-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}`