CVE-2026-79621 Overview
CVE-2026-79621 affects the CatalogX WordPress plugin in versions before 6.1.3. The plugin fails to sanitise or escape content that unauthenticated users can store through its product enquiry feature. When a later visitor submits a product enquiry, the plugin includes the attacker-controlled content in a notification email delivered to the site administrator. This allows unauthenticated attackers to inject arbitrary content into administrator inboxes without any direct interaction with their target. The issue is classified under [CWE-345] (Insufficient Verification of Data Authenticity).
Critical Impact
Unauthenticated attackers can inject arbitrary content into administrator notification emails, enabling phishing lures and social engineering targeting site operators.
Affected Products
- CatalogX WordPress plugin versions prior to 6.1.3
- WordPress installations with the CatalogX product enquiry feature enabled
- Site administrators receiving CatalogX enquiry notification emails
Discovery Timeline
- 2026-09-02 - CVE-2026-79621 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-79621
Vulnerability Analysis
The CatalogX plugin exposes a product enquiry workflow that accepts input from unauthenticated visitors. That input is stored and later embedded, without sanitisation or escaping, into a notification email sent to the site administrator. Because the email is generated when a subsequent visitor triggers an enquiry, the attack chains attacker-supplied content with a legitimate user action. The vulnerability requires user interaction from the victim path (UI:R) and produces a limited integrity impact against the notification channel rather than the WordPress site itself.
Root Cause
The root cause is missing input sanitisation and output escaping in the code path that builds the enquiry notification email body. The plugin trusts stored input as authentic content, which maps directly to [CWE-345]. Any string an unauthenticated user can persist through the enquiry feature reaches the administrator's mail client unchanged.
Attack Vector
An attacker submits crafted content through the CatalogX enquiry interface on a vulnerable site. The payload is stored by the plugin. When another visitor legitimately submits a product enquiry, the plugin composes the administrator notification email and includes the attacker's stored content. The administrator receives an email that appears to originate from their own site but carries attacker-controlled text, links, or HTML fragments useful for phishing or brand impersonation. See the WPScan Vulnerability Report for additional technical detail.
No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose based on the vendor and WPScan advisories.
Detection Methods for CVE-2026-79621
Indicators of Compromise
- Administrator notification emails from the CatalogX plugin containing unexpected hyperlinks, HTML markup, or content unrelated to the enquired product.
- Enquiry records stored by the plugin containing scripting tokens, external URLs, or crafted phishing text in fields intended for short user messages.
- Bursts of low-value or automated product enquiries preceding the delivery of tampered administrator emails.
Detection Strategies
- Review CatalogX enquiry database entries for entries containing HTML tags, encoded characters, or URLs pointing to unrelated domains.
- Correlate outbound mail from the WordPress host with stored enquiry submissions to identify tampered notification bodies.
- Audit the plugin version reported by WordPress against 6.1.3 to identify vulnerable deployments across managed sites.
Monitoring Recommendations
- Alert on administrator inbox rules or mail-flow logs when CatalogX notification emails contain external links or markup.
- Monitor WordPress plugin inventory changes and flag any CatalogX installation reporting a version below 6.1.3.
- Track anomalous submission rates to the CatalogX enquiry endpoint from single source addresses.
How to Mitigate CVE-2026-79621
Immediate Actions Required
- Upgrade the CatalogX plugin to version 6.1.3 or later on every affected WordPress site.
- Review recent administrator notification emails for injected links and warn recipients not to interact with suspicious content.
- Purge or sanitise stored enquiry records that contain HTML or URL payloads submitted before the upgrade.
Patch Information
The vendor addressed the issue in CatalogX 6.1.3 by sanitising and escaping user-supplied content before it is included in the enquiry notification email. Refer to the WPScan Vulnerability Report for advisory details and remediation confirmation.
Workarounds
- Temporarily disable the CatalogX product enquiry feature until the plugin is updated.
- Route administrator notification emails through a mail gateway that strips HTML and rewrites external links.
- Restrict access to the enquiry endpoint using a web application firewall rule that blocks HTML tags and URL patterns in submitted fields.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.