CVE-2026-78576: 
WordPress vulnerability analysis and mitigation

CVE-2026-78576 is a SQL Injection vulnerability in the Readabler plugin for WordPress, affecting all versions prior to 2.0.18. The flaw allows unauthenticated remote attackers to append malicious SQL queries to existing database queries, enabling extraction of sensitive information from the WordPress database. It was published on August 25, 2026, with the advisory credited to Wordfence and originally reported by researcher "dutafi" on July 16, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NVD, though Patchstack rates it 9.3 (GitHub Advisory, Patchstack).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries within the Readabler plugin. Because the plugin fails to sanitize or parameterize input before incorporating it into SQL statements, an unauthenticated attacker can craft HTTP requests that append additional SQL logic to existing queries — a classic SQL injection pattern. No authentication or user interaction is required, and the attack is executable remotely over the network with low complexity. No public proof-of-concept code has been identified at the time of disclosure (GitHub Advisory, Patchstack).

Successful exploitation allows an unauthenticated attacker to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, configuration data, and any other content stored in the database. The confidentiality impact is rated High, while integrity and availability are unaffected by this vulnerability alone. Extracted credentials could enable further account takeover or lateral movement within the WordPress environment (GitHub Advisory, Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that SQL injection vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress plugins (Patchstack, GitHub Advisory).

The primary remediation is to update the Readabler plugin to version 2.0.18 or later, which contains the fix for this SQL injection vulnerability. If immediate patching is not feasible, disabling the plugin until the update can be applied is recommended to eliminate the attack surface. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. WordPress site administrators should also review database logs for anomalous query patterns as a precautionary measure (Patchstack, GitHub Advisory).