CVE-2026-94117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94117", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-09-20T15:54:22.696Z", "datePublished": "2026-09-22T09:13:36.705Z", "dateUpdated": "2026-09-22T10:15:28.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-22T09:13:36.705Z"}, "title": "WordPress HashBar \u2013 WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "affected": [{"vendor": "DevItems", "product": "HashBar \u2013 WordPress Notification Bar", "collectionURL": "https://wordpress.org/plugins", "packageName": "hashbar-wp-notification-bar", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "2.0.3", "changes": [{"at": "2.0.4", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar \u2013 WordPress Notification Bar allows Blind SQL Injection.\n\nThis issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 2.0.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar \u2013 WordPress Notification Bar allows Blind SQL Injection.<p>This issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 2.0.3.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/hashbar-wp-notification-bar/vulnerability/wordpress-hashbar-wordpress-notification-bar-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L"}}], "solutions": [{"lang": "en", "value": "Update the WordPress HashBar \u2013 WordPress Notification Bar Plugin to the latest available version (at least 2.0.4).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress HashBar \u2013 WordPress Notification Bar Plugin to the latest available version (at least 2.0.4)."}]}], "credits": [{"lang": "en", "value": "Ananda Dhakal | Patchstack", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T10:07:22.173645Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T10:15:28.375Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T10:07:22.173645Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T10:14:57.901Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress HashBar \u2013 WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ananda Dhakal | Patchstack"}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DevItems", "product": "HashBar \u2013 WordPress Notification Bar", "versions": [{"status": "affected", "changes": [{"at": "2.0.4", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.0.3"}], "packageName": "hashbar-wp-notification-bar", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress HashBar \u2013 WordPress Notification Bar Plugin to the latest available version (at least 2.0.4).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress HashBar \u2013 WordPress Notification Bar Plugin to the latest available version (at least 2.0.4).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/hashbar-wp-notification-bar/vulnerability/wordpress-hashbar-wordpress-notification-bar-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar \u2013 WordPress Notification Bar allows Blind SQL Injection.\n\nThis issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 2.0.3.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar \u2013 WordPress Notification Bar allows Blind SQL Injection.<p>This issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 2.0.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-22T09:13:36.705Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94117", "state": "PUBLISHED", "dateUpdated": "2026-09-22T10:15:28.375Z", "dateReserved": "2026-09-20T15:54:22.696Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-09-22T09:13:36.705Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "hashbar-wp-notification-bar", "product": "HashBar \u2013 WordPress Notification Bar", "vendor": "DevItems", "versions": [{"changes": [{"at": "2.0.4", "status": "unaffected"}], "lessThanOrEqual": "2.0.3", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar \u2013 WordPress Notification Bar allows Blind SQL Injection.\n\nThis issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 2.0.3."}], "id": "CVE-2026-94117", "lastModified": "2026-09-22T19:04:55.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94117", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T10:07:22.173645Z", "version": "2.0.3"}}]}, "published": "2026-09-22T10:17:10.167", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/hashbar-wp-notification-bar/vulnerability/wordpress-hashbar-wordpress-notification-bar-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[2.0.4,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "HashBar \u2013 WordPress Notification Bar", "source": "cna", "vendor": "DevItems"}, "product": "hashbar_\u2013_wordpress_notification_bar", "vendor": "devitems"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "created": "2026-09-22T10:30:17.391858+00:00", "updated": "2026-09-22T10:30:17.556320+00:00", "vendors": ["devitems", "devitems$PRODUCT$hashbar_\u2013_wordpress_notification_bar", "wordpress", "wordpress$PRODUCT$wordpress"]}