CVE-2026-6453
Received Received - Intake

SQL Injection in CubeWP Framework WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-6453
EUVD
EUVD-2026-51792

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cubewp cubewp_framework to 1.1.30 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CubeWP Framework plugin for WordPress has a SQL Injection vulnerability in versions up to 1.1.30. The issue is in the cubewp_remove_relation() AJAX function where the relation_id parameter is not properly sanitized before being used in a raw SQL query. The wp_unslash() function removes backslash escaping added by WordPress, removing the only layer of SQL injection protection. This allows authenticated attackers with subscriber-level access or higher to inject additional SQL queries.

Detection Guidance

Detecting this vulnerability requires checking for the CubeWP Framework plugin version 1.1.30 or lower. Use WordPress admin to inspect installed plugins or run SQL queries to verify plugin versions. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to execute unauthorized SQL queries on your WordPress database. They could extract sensitive data like user credentials, modify or delete database content, or even take control of your website. Since it requires only subscriber-level access, the risk is significant for sites with public registration enabled.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA requirements for data protection. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Immediately update the CubeWP Framework plugin to the latest version beyond 1.1.30. If an update is unavailable, consider disabling the plugin or restricting access to subscriber-level users to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart