CVE-2026-94298
Received Received - Intake

SQL Injection in BuildKit WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-94298
EUVD
EUVD-2026-91195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
buildkit plugin to 1.0.29 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuildKit WordPress plugin before version 1.0.29 has a stored SQL injection vulnerability. Contributor-level users can submit unsanitized data that is later used in SQL queries when content is published. This allows attackers to inject malicious SQL code into the database.

Detection Guidance

To detect this vulnerability, check if the BuildKit WordPress plugin version is prior to 1.0.29. You can use WordPress commands like 'wp plugin list' or inspect the plugin files directly. Look for the 'list_content' parameter in the plugin's code or database entries.

Impact Analysis

An attacker with contributor access could manipulate the database, steal sensitive data, modify content, or take control of the WordPress site. Unauthenticated visitors viewing published content could trigger the injected SQL queries.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately update the BuildKit plugin to version 1.0.29 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Regularly audit user roles and permissions to ensure contributors do not have unnecessary database access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94298. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart