SQL Injection Vulnerability in User Login History Plugin for WordPress
CVE-2026-2283

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
User Login History
Vendor
CVE Published:
16 August 2026

What is CVE-2026-2283?

The User Login History plugin for WordPress is affected by a SQL Injection vulnerability through the 'blog_id' parameter, impacting all versions up to and including 2.1.7. Due to inadequate input escaping and insufficient preparations in the SQL statements, authenticated attackers with Administrator-level access can exploit this vulnerability in multisite WordPress installations. By injecting additional SQL commands, attackers can manipulate existing queries and potentially gain access to sensitive information stored in the database.

Affected Version(s)

User Login History 0 <= 2.1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/user-login-his...
https://plugins.trac.wordpress.org/browser/user-login-his...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nikola Kojic
.