CVE-2026-91074
Received Received - Intake

SQL Injection in BSK PDF Manager WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: WPScan

Description
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-91074
EUVD
EUVD-2026-103249

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown BSK PDF Manager 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BSK PDF Manager WordPress plugin through version 3.8.1 has a SQL injection vulnerability due to improper sanitization and escaping of the 'tags_specific' shortcode attribute. This allows authenticated users with contributor-level access or higher to execute SQL injection attacks.

Detection Guidance

Check if the BSK PDF Manager WordPress plugin version 3.8.1 or below is installed. Look for suspicious SQL queries or unauthorized database access attempts in logs.

Impact Analysis

This vulnerability could allow attackers to read sensitive data from the database, such as administrator password hashes. It requires at least contributor-level access but could lead to unauthorized data access or manipulation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data protection and access controls.

Mitigation Strategies

Disable or uninstall the BSK PDF Manager plugin immediately. Restrict database access permissions for contributor-level users. Monitor for unusual database activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart