CVE-2026-3781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3781", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-08T03:47:24.636Z", "datePublished": "2026-04-08T06:43:43.314Z", "dateUpdated": "2026-04-08T17:31:41.656Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:41.656Z"}, "affected": [{"vendor": "tnomi", "product": "Attendance Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L148"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Maurice Fielenbach"}], "timeline": [{"time": "2026-04-07T17:38:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T13:53:44.138756Z", "id": "CVE-2026-3781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:53:51.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T13:53:44.138756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:53:48.575Z"}}], "cna": {"title": "Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Maurice Fielenbach"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "tnomi", "product": "Attendance Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-07T17:38:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L148"}], "descriptions": [{"lang": "en", "value": "The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T06:43:43.314Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3781", "state": "PUBLISHED", "dateUpdated": "2026-04-08T13:53:51.996Z", "dateReserved": "2026-03-08T03:47:24.636Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T06:43:43.314Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Attendance Manager", "vendor": "tnomi", "versions": [{"lessThanOrEqual": "0.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Attendance Manager para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'attmgr_off' en todas las versiones hasta la 0.6.2, inclusive. Esto se debe a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-3781", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T13:53:44.138756Z", "version": "2.0.3"}}]}, "published": "2026-04-08T07:16:22.067", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L142"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L148"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Attendance Manager", "source": "cna", "vendor": "tnomi"}, "product": "attendance_manager", "vendor": "tnomi"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T08:20:51.159610+00:00", "value": {"mitigation_remediation": ["Upgrade the Attendance Manager plugin to a version newer than 0.6.2.", "If an upgrade is not immediately possible, remove or restrict the 'attmgr_off' parameter from accessible forms for users with Subscriber or lower roles.", "Verify that the WordPress installation has updated security patches applied to the core and all plugins.", "Monitor database logs for unexpected query patterns that may indicate injection attempts."], "summary": {"action": "Patch", "impact": "SQL Injection enabling data exposure"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Attendance Manager plugin version 0.6.2 or older are affected. Attackers need only Subscriber\u2011level or higher privileges, which is common for normal site users.", "description_and_impact": "The Attendance Manager plugin for WordPress contains an SQL Injection flaw in the 'attmgr_off' parameter. Because the value provided by users is not properly escaped and the surrounding SQL statement is not prepared, attackers can inject additional SQL statements. This allows the execution of unauthorised queries that can read sensitive database contents, potentially exposing user information and other confidential data.", "risk_and_exploitability": "The flaw has a CVSS score of 5.4, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web\u2011based request that an authenticated user can send to the plugin. Once the attacker injects the malicious payload, the database can be queried for information, leading to confidentiality compromise. Because no public exploit is documented, the risk is moderate to high depending on the attacker\u2019s access level."}}}}, "created": "2026-04-08T19:31:01.263947+00:00", "updated": "2026-04-08T19:43:32.791848+00:00", "vendors": ["tnomi", "tnomi$PRODUCT$attendance_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}