{"id":"CVE-2026-6453","aliases":["EUVD-2026-51792","GHSA-fg67-hgjg-74qh"],"status":"published","title":"CubeWP Framework \u003c= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter","description":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00472,"percentile":0.41168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-08-01T08:32:28Z","modified":"2026-08-12T21:00:37Z","products":[{"vendor":"cubewp1211","product":"cubewp framework"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647620-e06a-49d5-8f9d-a59cb5a999b1?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/functions/admin-functions.php#L2655"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L261"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L261"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L251"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L251"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/functions/admin-functions.php#L2655"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627740%40cubewp-framework\u0026new=3627740%40cubewp-framework"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6453"},{"url":"https://github.com/advisories/GHSA-fg67-hgjg-74qh"}],"sources":{"cve":[{"id":"CVE-2026-6453","title":"CubeWP Framework \u003c= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter","description":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.","status":"published","published":"2026-08-01T08:32:28.613Z","modified":"2026-08-03T18:39:59.351Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-51792","description":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.","status":"published","published":"2026-08-01T08:32:28Z","modified":"2026-08-03T18:39:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.01774Z"}],"ghsa":[{"id":"GHSA-fg67-hgjg-74qh","title":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to...","description":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.","status":"published","published":"2026-08-01T09:30:25Z","modified":"2026-08-01T09:30:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:01.548476Z"}],"nvd":[{"id":"CVE-2026-6453","description":"The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb-\u003eprepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.","status":"published","published":"2026-08-01T09:17:02.53Z","modified":"2026-08-12T21:00:37.147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:34.290716Z"}]}}