CVE-2026-81800

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

Analysis

AI-generated

Technical impact

An unauthenticated attacker can inject arbitrary SQL through the WordPress Verified Reviews (Avis Vérifiés) plugin functions. The flaw allows read, modification, or deletion of database records, potentially exposing sensitive data or corrupting application integrity. The weakness maps to CWE-89, representing improper sanitization of untrusted input in database queries.

Affected Systems

The vulnerability affects all instances of the Verified Reviews (Avis Vérifiés) plugin released by Par avisverifies with version numbers 2.4.6 and earlier. Site administrators should verify the plugin version installed and confirm whether an upgrade is available from the vendor.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. While no EPSS value is provided, the lack of a KEV listing does not diminish the impact; the flaw is exploitable without authentication, likely via an HTTP request to a plugin endpoint. Attackers with internet access to the site can trigger the injection simply by crafting a request, making the risk high for sites running the affected plugin.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Verified Reviews (Avis Vérifiés) plugin to release 2.4.7 or later, which resolves the injection flaw.
  • If an update is not immediately feasible, remove or deactivate the plugin to eliminate the attack surface.
  • As an interim measure, restrict unauthenticated access to the plugin’s endpoints using a web application firewall or by applying a path‑based access rule in the server configuration.

Generated by OpenCVE AI on September 10, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Par Avisverifies
Par Avisverifies verified Reviews (avis Vérifiés)
Wordpress
Wordpress wordpress
Vendors & Products Par Avisverifies
Par Avisverifies verified Reviews (avis Vérifiés)
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
Title WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Sep 11, 2026, 8:19 PM
Reserved
Aug 27, 2026, 12:24 PM

View source JSON

Updated
Sep 11, 2026, 8:13 PM

JSON

Status
Deferred
Published
Sep 10, 2026, 3:17 PM
Modified
Sep 11, 2026, 9:17 PM

View source JSON

No data.

Updated
Sep 13, 2026, 8:00 PM

JSON