Time-Based Blind SQL Injection in Eight Day Week Print Workflow Plugin for WordPress

CVE-2026-5028

What is CVE-2026-5028?

The Eight Day Week Print Workflow plugin for WordPress contains a vulnerability that allows for time-based blind SQL injection through the 'title' parameter in the pp-get-articles AJAX action. This is due to inadequate escaping of user-supplied input and a lack of proper preparation of the SQL query. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to inject additional SQL queries, enabling them to access and extract sensitive information from the database.

References