CVE-2026-115224
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Customer Engagement System plugin for WordPress before 2.0.2 does not safely build the SQL statements storing a popup's page and category visibility rules, concatenating request-supplied IDs directly into an INSERT statement without parameter binding or integer casting. This allows an authenticated administrator to inject arbitrary SQL and read the WordPress database contents.
Risk Assessment
An administrator (or an attacker who takes over an admin account) can read the entire WordPress database, including sensitive data. This requires administrative privileges, which limits the attack vector.
Recommendation
Update the Customer Engagement System plugin to version 2.0.2 or later. Ensure strong authentication for administrative accounts.
Other vulnerabilities in Customer Engagement System
Original NVD description (English source)
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS