SQL Injection Vulnerability in Peer-to-Peer Plugin for WordPress

CVE-2026-82568

What is CVE-2026-82568?

The Give - Peer-to-Peer plugin for WordPress is exposed to a time-based SQL Injection vulnerability through the 'sort' parameter. This issue arises from inadequate escaping of user-supplied input and insufficient SQL query preparation. As a result, unauthenticated attackers may exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data stored in the database. Successful exploitation requires at least one Peer-to-Peer campaign to be active. Additionally, this vulnerability can be exploited in conjunction with other vulnerabilities to facilitate unauthorized remote code execution.

References