CVE-2026-2495: WPNakama WordPress Plugin SQLi Vulnerability

CVE-2026-2495 Overview

The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress contains a SQL Injection vulnerability in its REST API endpoint. The vulnerability exists in the order parameter of the /wp-json/WPNakama/v1/boards endpoint, allowing unauthenticated attackers to inject malicious SQL queries into the application's database operations. This security flaw affects all versions up to and including 0.6.5.

Critical Impact

Unauthenticated attackers can extract sensitive information from the WordPress database, including user credentials, personal data, and potentially administrative credentials, without requiring any authentication.

Affected Products

• WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin versions ≤ 0.6.5
• WordPress installations with WPNakama plugin installed
• Sites exposing the /wp-json/WPNakama/v1/boards REST API endpoint

Discovery Timeline

• February 18, 2026 - CVE-2026-2495 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2495

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from improper handling of user-supplied input in the WPNakama plugin's REST API. The order parameter in the /wp-json/WPNakama/v1/boards endpoint accepts user input that is directly incorporated into SQL queries without proper sanitization or parameterization. The vulnerability can be exploited remotely over the network without any user interaction or authentication requirements.

The vulnerability allows attackers to append additional SQL queries to existing database operations, enabling extraction of confidential information. Since no authentication is required, any remote attacker with network access to the WordPress site can exploit this flaw. The impact is primarily focused on confidentiality, allowing unauthorized read access to database contents.

Root Cause

The root cause of this vulnerability is insufficient escaping of the user-supplied order parameter and the lack of proper prepared statements in the SQL query construction. The vulnerable code in class-wpnakama-api.php at line 209 and class-wpnakama.php at line 215 fails to properly sanitize input before incorporating it into database queries. WordPress provides functions like $wpdb->prepare() for safe query construction, but these were not adequately implemented in the affected code paths.

Attack Vector

The attack vector is network-based, targeting the WordPress REST API. An attacker can craft malicious HTTP requests to the /wp-json/WPNakama/v1/boards endpoint with specially crafted order parameter values containing SQL injection payloads.

The exploitation technique involves injecting SQL syntax into the order parameter to manipulate the query execution. By using techniques such as UNION-based injection, error-based injection, or time-based blind injection, attackers can systematically extract database contents including usernames, password hashes, email addresses, and other sensitive data stored in the WordPress database. The attack requires no authentication and can be performed by any remote attacker with HTTP access to the target site.

Detection Methods for CVE-2026-2495

Indicators of Compromise

• Unusual HTTP requests to /wp-json/WPNakama/v1/boards endpoint containing SQL keywords like UNION, SELECT, FROM, or encoded variations
• Web server logs showing repeated requests to the WPNakama REST API endpoint with abnormal parameter values
• Database query logs indicating unexpected or malformed queries originating from the WPNakama plugin
• Evidence of bulk data extraction or anomalous database read operations

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the order parameter
• Monitor web server access logs for suspicious requests targeting /wp-json/WPNakama/v1/boards with injection indicators
• Deploy database activity monitoring to identify unusual query patterns or unauthorized data access
• Use intrusion detection systems with SQL injection signature detection capabilities

Monitoring Recommendations

• Enable verbose logging for WordPress REST API endpoints and review logs regularly for anomalous activity
• Implement rate limiting on REST API endpoints to slow down automated exploitation attempts
• Set up alerts for database queries containing unexpected SQL syntax from the WPNakama plugin
• Monitor for signs of data exfiltration such as unusually large response sizes from the boards endpoint

How to Mitigate CVE-2026-2495

Immediate Actions Required

• Update the WPNakama plugin to a version newer than 0.6.5 that contains the security fix
• If no patched version is available, temporarily disable or remove the WPNakama plugin until a fix is released
• Implement WAF rules to block requests containing SQL injection patterns to the affected endpoint
• Review database access logs for any signs of prior exploitation

Patch Information

A security fix has been committed to the WPNakama plugin. Review the WordPress Plugin Changeset for details on the applied fix. The vulnerable code locations can be reviewed in the WPNakama API Class and WPNakama Main Class. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Block access to the /wp-json/WPNakama/v1/boards endpoint at the web server or firewall level until a patch is applied
• Implement a custom WordPress filter to sanitize the order parameter before it reaches the plugin code
• Restrict REST API access to authenticated users only using WordPress security plugins
• Consider using a reverse proxy with SQL injection filtering capabilities

# Apache .htaccess rule to block access to the vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/WPNakama/v1/boards [NC]
RewriteRule .* - [F,L]
</IfModule>