CVE-2026-3334
Published: 21 March 2026
Summary
CVE-2026-3334 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3334 is a SQL injection vulnerability in the CMS Commander plugin for WordPress, affecting all versions up to and including 2.288. The issue stems from insufficient escaping of the user-supplied parameters 'or_blogname', 'or_blogdescription', and 'or_admin_email', combined with a lack of sufficient preparation in the existing SQL queries within the plugin's restore workflow.
Authenticated attackers with CMS Commander API key access can exploit this vulnerability remotely with low attack complexity and no user interaction required. By appending additional SQL queries to existing ones, they can extract sensitive information from the database, resulting in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-89.
Advisories and references, including the Wordfence threat intelligence page and code excerpts from the plugin's Backup.php file at lines 1366 and 1639 in the WordPress trac repository, detail the vulnerable code locations in the restore workflow but do not specify mitigation steps or patches in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14016
Vulnerability details
The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of…
more
sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers, with CMS Commander API key access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and arbitrary database queries for data collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of user-supplied parameters like 'or_blogname' before use in SQL queries, preventing injection in the restore workflow.
Mandates timely remediation of the identified SQL injection flaw in the CMS Commander plugin, eliminating the vulnerability.
Facilitates identification of the SQL injection vulnerability through automated scanning of the WordPress plugin during vulnerability monitoring.