CVE-2026-28136: 
WordPress vulnerability analysis and mitigation

CVE-2026-28136 is an SQL Injection vulnerability in the VeronaLabs WP SMS WordPress plugin, classified under CWE-89. It affects all versions of WP SMS through and including 6.9.12. The vulnerability was disclosed on February 26, 2026, with the CVE received from Patchstack and subsequently modified by CISA-ADP. It carries a CVSS v3.1 base score of 7.6 (High), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is rooted in improper neutralization of special elements used in SQL commands (CWE-89), meaning user-supplied input is not adequately sanitized or parameterized before being incorporated into database queries within the WP SMS plugin. Exploitation requires network access and high privileges (e.g., an authenticated administrator-level user), with no user interaction needed and low attack complexity. The changed scope in the CVSS vector indicates that a successful attack can impact resources beyond the vulnerable component itself, such as the underlying WordPress database (NVD, Patchstack).

Successful exploitation of this vulnerability can result in high confidentiality impact, allowing an attacker to read sensitive data from the WordPress database — including user credentials, SMS logs, phone numbers, and other personal information managed by the WP SMS plugin. Availability is also partially affected (low impact), potentially disrupting plugin or database functionality. Integrity is not directly impacted according to the CVSS assessment, though database read access could facilitate further attacks such as credential theft and account takeover (NVD).

The EPSS score for CVE-2026-28136 is approximately 0.021% (0.000210), indicating a low current probability of exploitation in the wild. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (authenticated access), which limits the attack surface compared to unauthenticated vulnerabilities (NVD, Patchstack).

Users should update the WP SMS plugin to a version beyond 6.9.12, as all versions up to and including 6.9.12 are affected. The fix was disclosed by Patchstack, and site administrators should check the WordPress plugin repository or the VeronaLabs official channel for the patched release. As an interim measure, restricting administrative access to trusted users and monitoring database query logs for anomalous SQL patterns can reduce risk (Patchstack, NVD).

The vulnerability received standard coverage from vulnerability aggregation platforms including Vulners, VulDB, and CIRCL shortly after disclosure. A brief mention appeared in the Straylight Sentinel cybersecurity brief on February 27, 2026, and the vulnerability was noted on Bluesky's CVE feed. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.