SQL Injection Vulnerability in Album Cover Finder Plugin by WordPress
CVE-2026-84047

Currently unrated

Key Information:

Vendor

WordPress
Status
Album Cover Finder
Vendor
CVE Published:
12 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84047?

The Album Cover Finder plugin for WordPress, up to version 0.7.0, contains a security flaw that fails to adequately sanitize and escape user input within SQL queries. This oversight allows unauthenticated attackers to execute arbitrary SQL commands, potentially exposing sensitive database information or modifying data structures within the WordPress installation.

Affected Version(s)

Album Cover Finder 0 <= 0.7.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84047 - Proof of Concept

References

https://wpscan.com/vulnerability/eebacbae-4b25-45b5-96d9-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Ramos Maciel
WPScan
.