Cyber Resilience

CVE-2026-28115

Critical

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0024 15.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-28115 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-28115 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), in the WP Attractive Donations System - Easy Stripe & Paypal donations WordPress plugin developed by loopus. This issue affects all versions of the plugin from n/a through 1.25.

The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), making it exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation enables high confidentiality impact, such as extracting sensitive database information through blind SQL techniques, with changed scope, no integrity impact, and low availability impact.

Patchstack has documented this SQL injection vulnerability in the WP Attractive Donations System plugin up to version 1.25, providing details via their vulnerability database entry.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe &…

more

Paypal donations: from n/a through <= 1.25.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Blind SQL injection in a public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) for unauthenticated network exploitation and facilitates T1213.006 (Data from Information Repositories: Databases) via blind SQL techniques to extract sensitive database contents.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89
CVE-2019-25526Shared CWE-89
CVE-2025-69365Shared CWE-89
CVE-2019-25573Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 directly prevents blind SQL injection like CVE-2026-28115 by requiring validation and sanitization of all user inputs before incorporation into SQL commands.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely remediation of identified flaws, such as patching the vulnerable WP Attractive Donations System plugin up to version 1.25.

SC-7 Boundary Protection partial match
preventdetect

SC-7 provides boundary protection via web application firewalls that inspect traffic and block SQL injection payloads targeting the vulnerable plugin.

References