Unauthenticated SQL Injection in Boost Plugin by WordPress
CVE-2026-32555

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Boost
Vendor
CVE Published:
24 August 2026

What is CVE-2026-32555?

The Boost plugin for WordPress is affected by an unauthenticated SQL injection vulnerability that exists in versions up to 2.0.4. This flaw allows malicious attackers to execute arbitrary SQL queries against the database. By exploiting this vulnerability, attackers may gain unauthorized access to sensitive information, modify the database, or perform various other unauthorized actions. It is crucial for users of the Boost plugin to update to the latest secure version to mitigate the risk associated with this security issue. Regular patching and security assessments are recommended for maintaining a robust security posture.

Affected Version(s)

Boost <= 2.0.4

References

https://patchstack.com/database/wordpress/plugin/boost/vu...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

luc | Patchstack Bug Bounty Program
.