9.3Critical

CVE-2024-56039WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability

VibeThemes VibeBP Published: 2024-12-31 15:55 (1 year ago)

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
VibeThemes	VibeBP	≤ 1.9.9.7.7

References and patches

https://patchstack.com/database/Wordpress/Plugin/vibebp/vulnerability/wordpress-vibebp-plugin-1-9-9-7-7-unaut… vdb-entry

CVSS score

9.3Critical

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS (chance of exploitation in 30 days)

0.61%

higher than 49% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2024-12-14
Published2024-12-31 15:55
Reached IP-DB2026-10-24 23:54
Last updated2026-04-28 19:10

Assigned by (CNA): Patchstack

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-124822 2 hours ago

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

Easy DragDrop File Uploader

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Unscored

CVE-2026-124833 2 hours ago

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

Ahime Image Printer

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

Unscored

CVE-2026-125711 2 hours ago

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …

Unscored

CVE-2026-125912 2 hours ago

WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbit…

Unscored

CVE-2026-126119 2 hours ago

Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

Streamit

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated …

Unscored

CVE-2026-123097 2 hours ago

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

WP Remote Users Sync

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any ex…