CVE-2026-84068

The Quentn WP WordPress plugin before 1.2.15 fails to adequately escape a request parameter before inserting it into an unprepared SQL query, creating an unauthenticated SQL injection flaw (CWE-89). An attacker with no account or privileges can send a crafted request to the affected site and have malicious SQL executed within the query. Because the query is unprepared and unescaped, the attacker can extract arbitrary data from the WordPress database, which may include user records, password hashes, post content, or plugin and site settings; the CVSS 8.6 score reflects high confidentiality impact with no integrity or availability impact. All WordPress sites running a version of Quentn WP prior to 1.2.15 are affected. As of now there is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update the Quentn WP plugin to version 1.2.15 or later, which contains the fix. If an immediate update is not possible, deactivate the plugin or restrict unauthenticated access to its endpoints until patched. Review web access logs for suspicious requests and check the database for indications of unauthorized data reads.