CVE-2026-2495

High

Published: 18 February 2026

Published

18 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0005 14.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2495 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2495 is a SQL injection vulnerability in the WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress. It affects all versions up to and including 0.6.5 and stems from insufficient escaping of the user-supplied 'order' parameter in the '/wp-json/WPNakama/v1/boards' REST API endpoint, combined with inadequate preparation of the underlying SQL query. Published on 2026-02-18, the flaw is rated 7.5 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-89.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges. By appending malicious SQL queries to the existing ones via the 'order' parameter, they can extract sensitive information from the database, such as user credentials or other confidential data stored by the plugin.

References provided include source code locations in class-wpnakama-api.php (line 209) and class-wpnakama.php (line 215) for both the 0.6.5 tag and trunk, along with changeset 3461315 in the WordPress plugin trac repository, which likely documents the patch applied to address the issue in newer versions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-8047

Vulnerability details

The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due…

to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in unauthenticated public WordPress REST endpoint directly enables remote exploitation of a public-facing application (T1190) and extraction of data from the backend database (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1