CVE-2026-32499

Critical

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0028 19.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-32499 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32499 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), affecting the QuantumCloud ChatBot WordPress plugin. The issue impacts ChatBot versions from n/a through 7.7.9. It carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for high confidentiality impact with a changed scope.

Unauthenticated attackers can exploit this vulnerability remotely over the network. By injecting malicious SQL payloads, they can perform blind SQL injection to extract sensitive data from the database, achieving high confidentiality impact. The exploitation also results in low availability impact, with the changed scope allowing broader consequences beyond the vulnerable component.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-chatbot-plugin-7-7-9-sql-injection-vulnerability?_s_id=cve provides details on this WordPress ChatBot plugin 7.7.9 SQL injection vulnerability, including recommendations for mitigation such as updating to a patched version where available.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15847

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Blind SQL injection in unauthenticated public-facing WordPress plugin directly enables remote exploitation for data extraction from the application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0