CVE-2026-82304
Received Received - Intake

SQL Injection in Music Store WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-82304
EUVD
EUVD-2026-71856

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_music_store wordpress_plugin to 1.4.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Music Store WordPress plugin before version 1.4.5 has a SQL injection vulnerability because it does not properly sanitize or escape user input before using it in SQL statements. This allows unauthenticated attackers to inject malicious SQL commands.

Detection Guidance

To detect this vulnerability, check if the Music Store WordPress plugin version is below 1.4.5. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Network scanning tools may not directly detect SQL injection but can identify outdated plugins.

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands on your database without authentication. This could lead to unauthorized data access, modification, or deletion, potentially exposing sensitive information stored in the database.

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access to personal or health data could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update the Music Store WordPress plugin to version 1.4.5 or higher. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure your WordPress installation and all plugins are regularly updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart