SQL Injection Vulnerability in Tcard WP Plugin for WordPress
CVE-2026-81420
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-81420?
The Tcard WP WordPress plugin, up to version 1.8.0, exhibits a serious security flaw by failing to properly sanitize and escape a parameter within an unauthenticated AJAX action. This oversight allows unauthorized users to manipulate SQL statements, potentially leading to SQL injection attacks. If exploited, this vulnerability may compromise the integrity and confidentiality of database information, making it imperative for users to update their plugins promptly and implement security best practices to mitigate the risk.
Affected Version(s)
Tcard WP 0 <= 1.8.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.