SQL Injection Vulnerability in Sirv Plugin by Sirv
CVE-2026-104389

8.5HIGH

Key Information:

Vendor

WordPress
Status
Sirv
Vendor
CVE Published:
5 October 2026

What is CVE-2026-104389?

An SQL Injection vulnerability in the Sirv plugin allows for blind SQL injection attacks. This weakness can be exploited by an attacker to manipulate database queries, potentially leading to unauthorized access and data exposure. It affects versions of the Sirv plugin from its initial release through 8.2.5. Users are strongly advised to update to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Sirv 0 <= 8.2.5

References

https://patchstack.com/database/wordpress/plugin/sirv/vul...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Tang | Patchstack Bug Bounty Program
.