CVE-2026-5028: Eight Day Week Plugin SQLi Vulnerability

CVE-2026-5028 Overview

CVE-2026-5028 is a time-based blind SQL injection vulnerability in the Eight Day Week Print Workflow plugin for WordPress. The flaw affects all versions up to and including 1.2.6. It resides in the pp-get-articles AJAX action, where the title parameter is concatenated into a SQL query without sufficient escaping or preparation. Authenticated users with Subscriber-level access or higher can append arbitrary SQL fragments to the existing query. Successful exploitation enables extraction of sensitive database contents such as user credentials, session tokens, and configuration data. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can exfiltrate arbitrary database contents through time-based blind SQL injection.

Affected Products

Eight Day Week Print Workflow WordPress plugin versions through 1.2.6
WordPress sites permitting Subscriber-level (or higher) registrations with the plugin enabled
Any site exposing the pp-get-articles AJAX endpoint to authenticated users

Discovery Timeline

2026-05-12 - CVE-2026-5028 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-5028

Vulnerability Analysis

The Eight Day Week Print Workflow plugin registers an AJAX action named pp-get-articles that retrieves article records from the WordPress database. The handler reads the title request parameter directly from $_POST and concatenates it into a SQL query without using $wpdb->prepare() or properly escaping user input. Because the underlying query is not parameterized, attackers can inject SQL syntax that the database server evaluates as part of the original statement.

The injection is time-based and blind. Attackers infer query results by triggering conditional SLEEP() calls and measuring response latency. While the response body does not return data directly, repeated binary-search style queries allow byte-by-byte extraction of strings such as administrator password hashes from wp_users or secret keys stored in wp_options.

Root Cause

The root cause is missing input sanitization and absent prepared statements in the article retrieval logic. The code paths referenced in the WordPress plugin source at line 41 and line 499 interpolate the title parameter into a SQL string. The plugin relies on implicit trust of authenticated request data rather than treating all client input as untrusted.

Attack Vector

Exploitation requires an authenticated session at the Subscriber role or higher, which is trivially obtainable on WordPress sites that allow user registration. The attacker submits a crafted POST request to wp-admin/admin-ajax.php with action=pp-get-articles and a malicious title value containing SQL conditionals and SLEEP() functions. By varying the payload and observing response time differences, the attacker extracts database content one bit at a time.

See the Wordfence Vulnerability Report for additional technical context on the affected request path.

Detection Methods for CVE-2026-5028

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=pp-get-articles and SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the title parameter
Anomalously long response times on admin-ajax.php requests, frequently in multiples of a fixed delay value
Repeated authenticated requests to the same AJAX action from a single Subscriber account within short time windows
Database query logs showing malformed WHERE clauses or unexpected substring comparisons against wp_users columns

Detection Strategies

Enable WordPress query logging or a Web Application Firewall (WAF) rule that inspects the title POST parameter for SQL metacharacters
Alert on admin-ajax.php responses exceeding a latency baseline, correlated with pp-get-articles actions
Hunt for newly registered low-privilege accounts that immediately invoke plugin AJAX endpoints

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized SIEM for correlation across sites
Track failed and successful authentications against Subscriber accounts and flag bursts of AJAX activity post-login
Monitor outbound database query duration metrics and alert on sustained spikes tied to the plugin handler

How to Mitigate CVE-2026-5028

Immediate Actions Required

Update the Eight Day Week Print Workflow plugin to a version newer than 1.2.6 once the vendor publishes a patched release
Disable the plugin on production WordPress instances if a patched version is not yet available
Audit user accounts and remove unused Subscriber-level registrations, and disable open registration if not required
Rotate WordPress secret keys in wp-config.php and reset administrator credentials if exploitation is suspected

Patch Information

At the time of publication, the NVD record references vulnerable code in version 1.2.6 of the plugin. Site operators should monitor the WordPress plugin repository for an updated release and apply it promptly. Confirm the fix introduces $wpdb->prepare() usage around the title parameter in includes/functions/articles.php.

Workarounds

Deploy a WAF rule blocking POST requests to admin-ajax.php where action=pp-get-articles and the title parameter contains SQL syntax tokens
Restrict access to wp-admin/admin-ajax.php from untrusted networks using IP allowlisting where operationally feasible
Disable new user registrations by unsetting the users_can_register option until the plugin is patched

bash

# Disable WordPress open registration via WP-CLI
wp option update users_can_register 0

# Deactivate the vulnerable plugin until a fix is available
wp plugin deactivate eight-day-week-print-workflow