CVE-2026-2279
Received Received - Intake
SQL Injection in myLinksDump WordPress Plugin Allows Data Exposure

Publication date: 2026-03-21

Last updated on: 2026-03-21

Assigner: Wordfence

Description
The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-21
Last Modified
2026-03-21
Generated
2026-05-07
AI Q&A
2026-03-21
EPSS Evaluated
2026-05-05
NVD
CVE-2026-2279
EUVD
EUVD-2026-14017
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
mylinksdump mylinks_dump to 1.6 (inc)
silvercover mylinksdump to 1.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The myLinksDump plugin for WordPress has a vulnerability known as SQL Injection in its 'sort_by' and 'sort_order' parameters. This happens because the plugin does not properly escape or prepare these user-supplied parameters before including them in SQL queries. As a result, authenticated users with administrator-level access or higher can insert additional malicious SQL commands into existing queries.

This vulnerability allows attackers to manipulate the database queries executed by the plugin.


How can this vulnerability impact me? :

This vulnerability can have serious impacts because it allows attackers with administrator-level access to execute arbitrary SQL commands on the database.

  • Extraction of sensitive information from the database.
  • Potential modification or deletion of data.
  • Compromise of the integrity, confidentiality, and availability of the affected system.

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart