CVE-2026-84047

The Album Cover Finder WordPress plugin through version 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, creating an unauthenticated SQL injection flaw. A remote attacker triggers it by sending a crafted request to the plugin's affected endpoint — no account, privileges, or user interaction are required. Successful exploitation lets the attacker read sensitive data from the WordPress database (the CVSS 3.1 score of 8.6 reflects high confidentiality impact across a changed scope), while integrity and availability are not directly affected per the scoring. Any site running the plugin at or below version 0.7.0 is affected. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: No patched version is identified in the data (0.7.0 appears to be the latest release), so the safest action is to deactivate and remove the plugin from any site where it is not essential. If it must remain, apply a WAF or virtual-patching rule that blocks SQL-injection patterns against the plugin's endpoints and review database and access logs for anomalous queries. Because injected queries can expose user tables and password hashes, consider rotating database credentials and forcing password resets for privileged accounts on affected sites.