CVE-2026-52712

Vulnerability

The Attendance Manager plugin for WordPress versions 0.6.2 and earlier contains a SQL injection vulnerability exploitable by users with the Subscriber role or higher. The vulnerability arises from insufficient sanitization of user-supplied input before inclusion in SQL queries, allowing an attacker to inject arbitrary SQL commands. [1]

Exploitation

An attacker must be authenticated as a Subscriber or higher. Successful exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page. Once triggered, the attacker can inject SQL commands into the database query. [1]

Impact

Successful exploitation enables the attacker to directly interact with the database, including reading, modifying, or deleting data. This could lead to information disclosure, privilege escalation, or full site compromise. The vulnerability is considered highly dangerous and is expected to be used in mass-exploit campaigns. [1]

Mitigation

The vulnerability is fixed in version 0.6.3. Users should update immediately. Patchstack has issued a mitigation rule to block attacks until the update is applied. [1]