Description
The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.
Published: 2026-09-26
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection allowing unauthenticated attackers to extract sensitive database information
Action: Immediate Patch
AI Analysis

Impact

Bluff Post plugin versions up to 1.1.1 fail to sanitise the table_name and column_name parameters used as identifiers in a SQL query, which allows attackers to append arbitrary SQL statements and read restricted database content. This vulnerability can result in disclosure of confidential data and may serve as a foothold for further compromise.

Affected Systems

Any WordPress installation using Bluff Post plugin version 1.1.1 or earlier is affected. The vulnerability exists in the plugin’s handling of the table_name and column_name request parameters.

Risk and Exploitability

The exploit does not require authentication and can be performed over the network via standard HTTP requests. Although the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, the lack of input validation combined with the nature of SQL injection makes it a moderate‑risk issue. An attacker can send crafted queries to the plugin's endpoints to access or exfiltrate data.

Generated by OpenCVE AI on September 27, 2026 at 01:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Bluff Post to the latest version that addresses the SQL injection flaw or permanently remove the plugin if it is no longer needed.
  • If an immediate update is not possible, restrict access to the plugin’s table_name and column_name parameters by limiting the endpoint to authorised users or by disabling them in the WordPress configuration.
  • Deploy a Web Application Firewall rule that blocks suspicious SQL patterns targeting these parameters to mitigate exploitation until a patch is applied.

Generated by OpenCVE AI on September 27, 2026 at 01:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions bluff Post
Vendors & Products Wordpress-extensions
Wordpress-extensions bluff Post

Sat, 26 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89

Sat, 26 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.
Title Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters
References

Subscriptions

Wordpress-extensions Bluff Post
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-26T22:41:15.689Z

Reserved: 2026-09-11T09:49:26.536Z

Link: CVE-2026-89237

cve-icon Vulnrichment

Updated: 2026-09-26T22:33:51.487Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T07:17:02.923

Modified: 2026-09-28T16:38:58.950

Link: CVE-2026-89237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T01:30:19Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')