CVE-2026-84047 Overview
CVE-2026-84047 is an unauthenticated SQL injection vulnerability in the Album Cover Finder WordPress plugin through version 0.7.0. The plugin fails to sanitize and escape a user-controlled parameter before passing it into a SQL query. Remote attackers can inject arbitrary SQL statements without authentication or user interaction. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Successful exploitation exposes database contents, including WordPress user records, credential hashes, and site configuration data.
Critical Impact
Unauthenticated attackers can extract confidential data from the WordPress database over the network with no privileges required.
Affected Products
- Album Cover Finder WordPress plugin, all versions through 0.7.0
- WordPress sites with the plugin installed and activated
- Any hosting environment exposing the vulnerable plugin endpoint to the internet
Discovery Timeline
- 2026-09-12 - CVE-2026-84047 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-84047
Vulnerability Analysis
The Album Cover Finder plugin accepts a request parameter and concatenates it directly into a SQL statement executed against the WordPress database. Because the plugin does not apply esc_sql(), prepared statements, or $wpdb->prepare(), an attacker controls fragments of the query syntax. The vulnerability is reachable without authentication, which removes any barrier to exploitation on internet-exposed sites. The scope change reflected in the vulnerability metrics indicates that data outside the plugin's boundary, including core WordPress tables such as wp_users and wp_options, can be read through the injected query.
Root Cause
The root cause is missing input validation and unsafe query construction. WordPress provides the $wpdb abstraction and prepare() method specifically to bind parameters safely, but the plugin bypasses these mechanisms. Refer to the WPScan Vulnerability Report for advisory details.
Attack Vector
Attackers send crafted HTTP requests to the vulnerable plugin endpoint with SQL payloads embedded in the affected parameter. Union-based, boolean-based, and time-based blind injection techniques all apply. Because no authentication is required, automated scanners can enumerate vulnerable sites and extract data at scale. No exploitation code has been published in the enriched data, and no proof-of-concept URLs are listed.
Detection Methods for CVE-2026-84047
Indicators of Compromise
- HTTP requests to Album Cover Finder plugin endpoints containing SQL keywords such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded variants
- Unexpected outbound database query patterns or long-running queries originating from the web server process
- New or modified WordPress administrator accounts appearing in wp_users without a corresponding audit trail
- Web server access logs showing repeated requests to the plugin from a single source with varying query parameters
Detection Strategies
- Deploy web application firewall (WAF) signatures targeting SQL injection payloads against WordPress plugin URIs
- Enable MySQL general query logging temporarily to identify suspicious query structures originating from the plugin
- Correlate HTTP 500 responses from the plugin endpoint with anomalous request parameters to surface probing attempts
Monitoring Recommendations
- Alert on requests to Album Cover Finder endpoints containing SQL meta-characters such as single quotes, comment sequences, or OR 1=1 patterns
- Monitor for privilege changes and new user creation events in the WordPress database
- Track query duration outliers that may indicate time-based blind SQL injection
How to Mitigate CVE-2026-84047
Immediate Actions Required
- Deactivate and remove the Album Cover Finder plugin until a patched version is available
- Restrict access to /wp-content/plugins/album-cover-finder/ at the web server or WAF layer
- Rotate WordPress administrator passwords and any database credentials that may have been exposed
- Review wp_users and wp_usermeta for unauthorized accounts or role changes
Patch Information
No vendor patch is referenced in the enriched CVE data. The plugin is affected through version 0.7.0, and no fixed version has been published. Site operators should treat the plugin as unmaintained and select an alternative until the maintainer issues a security update. Track the WPScan Vulnerability Report for updated remediation guidance.
Workarounds
- Block requests to the vulnerable plugin endpoint using WAF rules or .htaccess deny directives
- Enforce least-privilege database accounts so the WordPress user cannot read tables outside its schema
- Enable WordPress logging plugins to capture request bodies and query parameters for forensic review
- Deploy generic SQL injection filtering at the reverse proxy or CDN layer as a compensating control
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
