CVE-2026-81763

CVE-2026-81763 is an unauthenticated SQL injection (CWE-89) in the WordPress anti-spam plugin Throws SPAM Away, affecting all versions up to and including 3.8.2. Because the flaw requires no privileges and no user interaction, a remote attacker can trigger it directly with crafted input to an affected site's front end. The critical CVSS 3.1 score of 9.3 (high confidentiality impact, low availability impact, changed scope) indicates that sensitive database contents could be exposed, potentially beyond the plugin's own tables. Any WordPress site running Throws SPAM Away 3.8.2 or older is affected. No exploitation is currently known: EPSS is low at 0.2% over 30 days (~15th percentile), the issue is not in CISA KEV, and no public proof-of-concept or in-the-wild reports exist.

What to do: Update Throws SPAM Away to the newest release (any version above 3.8.2); the fixed version number is not given in the source data, so check the WordPress.org plugin page for the current release. Until patched, consider temporarily deactivating the plugin or deploying WAF rules that block common SQL injection patterns in unauthenticated front-end requests. Review web access logs for unauthenticated requests containing SQL syntax (e.g., quotes, UNION/SELECT payloads) and, if suspicious activity is found, treat database contents such as credentials as potentially exposed.