CVE-2026-82304

CVE-2026-82304 is an unauthenticated SQL injection (CWE-89) in the Music Store WordPress plugin, caused by user-supplied input being placed into a SQL statement without sanitisation or escaping. An attacker can trigger it remotely by sending crafted parameters to the plugin, with no account, authentication, or user interaction required. Successful injection can read data from the site database (high confidentiality impact per the CVSS 3.1 vector, with no listed integrity or availability impact), potentially exposing stored site content, user records, or other sensitive database information. Any WordPress installation running a version of Music Store older than 1.4.5 is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update the Music Store plugin to version 1.4.5 or later. Until patched, consider deactivating the plugin or applying WAF/virtual-patching rules that block SQL metacharacters in its request parameters, and review web-server access logs for unauthenticated requests containing SQL-injection patterns targeting the plugin.