SQL Injection Vulnerability in WP w3all phpBB Integration by axew3.com
CVE-2026-121769

8.5HIGH

Key Information:

Vendor

WordPress
Status
WP W3all PHPbb
Vendor
CVE Published:
9 November 2026

What is CVE-2026-121769?

The WP w3all phpBB Integration plugin for WordPress is susceptible to SQL Injection attacks, stemming from improper handling of special elements in SQL commands. This vulnerability could allow attackers to manipulate queries executed by the database, leading to unauthorized access to sensitive information or the alteration of site data. Users of this plugin, especially those running versions from n/a to 3.1.9, are strongly advised to apply patches as soon as possible to secure their installations against potential exploits.

Affected Version(s)

WP w3all phpBB 0 <= 3.1.9

References

https://patchstack.com/database/wordpress/plugin/wp-w3all...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nikita Mateo Volovik | Patchstack Bug Bounty Program
.