SQL Injection in Persistent Login Plugin for WordPress by WordPress

CVE-2026-18752

What is CVE-2026-18752?

The Persistent Login plugin for WordPress exhibits a vulnerability that allows for SQL injection via the 'wppl_device_id' cookie in versions up to and including 3.1.0. The vulnerability arises from inadequate escaping of a user-supplied parameter and insufficient preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can exploit this weakness, adding harmful SQL queries to existing ones, potentially gaining access to sensitive information stored in the database. This issue is particularly critical when the plugin's Login History feature is active.

References