CVE-2026-17017

None

Open

TLP:CLEAR

CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.

Details

EPSS Score ⓘ: 0.16%

5.2th percentile
Confidence: 90%
Published: Aug 9, 2026
Last Modified: Aug 10, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.