CVE-2026-2279

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2279", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-10T14:14:37.085Z", "datePublished": "2026-03-21T03:26:28.396Z", "dateUpdated": "2026-04-08T16:32:43.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:43.074Z"}, "affected": [{"vendor": "silvercover", "product": "myLinksDump", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L414"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L414"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "timeline": [{"time": "2026-03-20T15:16:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T15:17:27.689376Z", "id": "CVE-2026-2279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:18:12.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T15:17:27.689376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:18:06.719Z"}}], "cna": {"title": "myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters", "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "silvercover", "product": "myLinksDump", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:16:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L414"}, {"url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L414"}], "descriptions": [{"lang": "en", "value": "The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:43.074Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2279", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:32:43.074Z", "dateReserved": "2026-02-10T14:14:37.085Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:28.396Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "myLinksDump", "vendor": "silvercover", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin myLinksDump para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de los par\u00e1metros 'sort_by' y 'sort_order' en todas las versiones hasta la 1.6, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite a atacantes autenticados, con acceso de nivel de administrador y superior, a\u00f1adir consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-2279", "lastModified": "2026-06-17T10:30:42.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2279", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T15:17:27.689376Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:16:57.990", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L414"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php#L423"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L414"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php#L423"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6]"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "myLinksDump", "source": "cna", "vendor": "silvercover"}, "product": "mylinksdump_plugin", "vendor": "silvercover"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:22:47.698576+00:00", "value": {"mitigation_remediation": ["Upgrade the myLinksDump plugin to the latest available version, which removes the vulnerable SQL injection code.", "If an upgrade is not immediately feasible, restrict administrator access to the sorting functionality or disable the affected parameters altogether.", "As an interim measure, modify the plugin code to properly escape or bind the 'sort_by' and 'sort_order' inputs before inclusion in SQL statements.", "If neither upgrading nor patching is possible, remove or deactivate the myLinksDump plugin until a secure version is released."], "summary": {"action": "Patch Immediately", "impact": "SQL Injection leading to Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "All releases of the myLinksDump plugin distributed by Silvercover up to and including version 1.6 are affected. WordPress sites that run a vulnerable version of this plugin and allow administrators to use its sort functionality are at risk.", "description_and_impact": "The myLinksDump WordPress plugin contains a classic SQL injection flaw in the 'sort_by' and 'sort_order' request parameters. Input supplied by an authenticated administrator is inserted directly into a SQL query without escaping or proper preparation, allowing an attacker to append arbitrary SQL statements. This flaw enables the retrieval of confidential database information, thereby compromising data confidentiality and potentially data integrity if destructive queries were executed.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.2, indicating a medium to high severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated with administrator or higher privileges, so the attack vector is inferred to be through the authenticated use of the plugin\u2019s sorting controls."}}}}, "created": "2026-03-23T09:51:09.097784+00:00", "updated": "2026-03-25T14:42:44.286925+00:00", "vendors": ["silvercover", "silvercover$PRODUCT$mylinksdump_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}