Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-81420— Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

Quick assessment

Affected
Unknown Tcard WP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tcard WP WordPress 插件（版本 1.8.0 及之前）在使用某个未认证的 AJAX 操作时，未对参数进行 sanitise（净化）和 escape（转义）处理，直接将其用于 SQL 语句，导致未认证的攻击者可以执行 SQL 注入攻击。

AI Predicted 9.8 Difficulty: Trivial EPSS 0.32% · P24

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Tcard WP ≤ 1.8.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81420

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Tcard WP 0 ~ 1.8.0 -

II. Public POCs for CVE-2026-81420

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81420

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-11 · 63 CVEs total

CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query Stri
CVE-2026-89304 Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_com
CVE-2026-93550 Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connect
CVE-2026-89305 Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
CVE-2026-89302 Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
CVE-2026-89213 Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSet
CVE-2026-88903 Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
CVE-2026-89232 RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
CVE-2026-88826 SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Applicatio
CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
CVE-2026-86706 Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
CVE-2026-87762 Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Ju
CVE-2026-87760 Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

Showing top 20 of 63 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-81420

No comments yet

Leave a comment