CVE-2026-6674 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

💥 **Root Cause**: - **CWE-89**: SQL injection. - ❌ Insufficient escaping of the `arttype` parameter. - ❌ Missing prepared statements in SQL queries. - 🧩 Allows attackers to inject malicious SQL.

Q: Who is affected? (Versions/Components)

👥 **Scope of Impact**: - 📦 Plugin: **CMS für Motorrad Werkstätten**. - 🔢 Version: **≤ 1.0.0**. - 🖥️ Platform: WordPress.

Q: What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities**: - 🔑 Privilege: **Subscriber or higher**. - 🗃️ Can read **sensitive database information**. - 🚫 Cannot directly modify/delete (information disclosure only).

Q: Is exploitation threshold high? (Auth/Config)

🎯 **Exploitation Threshold**: - ✅ **Low**! - 🔐 Only requires a **logged-in account** (≥ subscriber). - ⚙️ No special configuration needed.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Existing Exploit**: - 📭 **No PoC** (`pocs` is empty). - 📉 **No in-the-wild exploitation reports**. - ⏳ But risk remains high⚠️.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check Method**: - 🔎 Check if plugin version is **≤ 1.0.0**. - 📂 Review file `cfmw-positions.php` lines 202 and 207. - 🧾 Confirm whether the `arttype` parameter is **filtered/prepared**.

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: - 📅 Release date: 2026-04-21. - 📌 Current data **does not mention a patch**. - 🔗 Reference link includes source code location → possibly disclosed, awaiting fix.

Q: What if no patch? (Workaround)

⚠️ **Temporary Mitigation**: - 🔒 **Immediately disable** the plugin. - 🚫 Restrict low-privileged users from accessing plugin features. - 🧼 Manually audit & add input filtering/parameterized queries.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: - 🚨 **High Priority**! - 🧨 Easy to exploit + information leakage risk. - 📣 Recommend **immediate investigation & remediation**.

Updated Apr 21, 2026 CVSS 6.5 · Medium

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Vulnerability Essence**: The WordPress plugin *CMS für Motorrad Werkstätten* ≤1.0.0 has an **SQL injection** vulnerability.

🔍 **Impact**: **Authenticated users** (≥ subscriber) can manipulate database queries → extr…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

💥 **Root Cause**:

- **CWE-89**: SQL injection.
- ❌ Insufficient escaping of the `arttype` parameter.
- ❌ Missing prepared statements in SQL queries.
- 🧩 Allows attackers to inject malicious SQL.

Q3Who is affected? (Versions/Components)

👥 **Scope of Impact**:

- 📦 Plugin: **CMS für Motorrad Werkstätten**.
- 🔢 Version: **≤ 1.0.0**.
- 🖥️ Platform: WordPress.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities**:

- 🔑 Privilege: **Subscriber or higher**.
- 🗃️ Can read **sensitive database information**.
- 🚫 Cannot directly modify/delete (information disclosure only).

Q5Is exploitation threshold high? (Auth/Config)

🎯 **Exploitation Threshold**:

- ✅ **Low**!
- 🔐 Only requires a **logged-in account** (≥ subscriber).
- ⚙️ No special configuration needed.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Existing Exploit**:

- 📭 **No PoC** (`pocs` is empty).
- 📉 **No in-the-wild exploitation reports**.
- ⏳ But risk remains high⚠️.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check Method**:

- 🔎 Check if plugin version is **≤ 1.0.0**.
- 📂 Review file `cfmw-positions.php` lines 202 and 207.
- 🧾 Confirm whether the `arttype` parameter is **filtered/prepared**.

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**:

- 📅 Release date: 2026-04-21.
- 📌 Current data **does not mention a patch**.
- 🔗 Reference link includes source code location → possibly disclosed, awaiting fix.

Q9What if no patch? (Workaround)

⚠️ **Temporary Mitigation**:

- 🔒 **Immediately disable** the plugin.
- 🚫 Restrict low-privileged users from accessing plugin features.
- 🧼 Manually audit & add input filtering/parameterized queries.

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**:

- 🚨 **High Priority**!
- 🧨 Easy to exploit + information leakage risk.
- 📣 Recommend **immediate investigation & remediation**.

Continue exploring

Vulnerability detail Full AI analysis (login) tholstkabelbwde CWE-89