CVE-2026-31917

High

Published: 13 March 2026

Published

13 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0031 22.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-31917 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-31917 is an SQL Injection vulnerability (CWE-89) in the weDevs WP ERP plugin for WordPress, stemming from improper neutralization of special elements used in an SQL command. The issue affects all versions of the WP ERP plugin up to and including 1.16.10. Published on March 13, 2026, it carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating high severity due to network accessibility, low attack complexity, and significant confidentiality impact across a changed scope.

A low-privileged authenticated user (PR:L) can exploit this vulnerability remotely over the network without user interaction. Successful exploitation allows the attacker to inject malicious SQL queries, potentially extracting sensitive data from the database (high confidentiality impact) and causing limited denial of service (low availability impact), with no direct integrity modification.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-16-10-sql-injection-vulnerability?_s_id=cve provides details on the vulnerability, recommending mitigation through updating to a patched version of the WP ERP plugin beyond 1.16.10.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-11792

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin directly enables T1190 exploitation for initial access and facilitates T1213.006 by allowing direct extraction of sensitive data from the backend database.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0