CVE-2026-87767: WordPress Shortcut Link Plugin SQLi Flaw

CVE-2026-87767 Overview

CVE-2026-87767 is an unauthenticated SQL injection vulnerability in the WP Shortcut Link and Advertisement Baner WordPress plugin through version 1.2.0. The plugin fails to sanitize and escape a user-controlled parameter before passing it to a SQL query. The vulnerable code path is exposed through an AJAX action that does not require authentication. Attackers can inject arbitrary SQL statements and extract sensitive data from the WordPress database, including user credentials, session tokens, and site configuration. The flaw is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database over the network without user interaction.

Affected Products

WP Shortcut Link and Advertisement Baner WordPress plugin, all versions through 1.2.0
WordPress installations with the affected plugin activated
Sites exposing admin-ajax.php to unauthenticated visitors (default WordPress behavior)

Discovery Timeline

2026-09-18 - CVE-2026-87767 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-87767

Vulnerability Analysis

The vulnerability resides in an AJAX handler registered by the WP Shortcut Link and Advertisement Baner plugin. WordPress plugins register AJAX callbacks using the wp_ajax_ and wp_ajax_nopriv_ hooks. When a handler is bound to wp_ajax_nopriv_, it is reachable by unauthenticated visitors through wp-admin/admin-ajax.php.

The affected handler reads a parameter from the HTTP request and concatenates it directly into a SQL statement executed against the WordPress database. The plugin does not apply wpdb::prepare(), esc_sql(), or type casting before the query executes. As a result, attackers can inject arbitrary SQL clauses, including UNION SELECT statements that read from tables such as wp_users and wp_usermeta.

Successful exploitation exposes password hashes, session tokens, API keys stored in options, and any custom data written by other plugins. The scope change flag in the CVSS vector reflects that data extraction extends beyond the plugin boundary to the entire WordPress database.

Root Cause

The root cause is missing input sanitization on a parameter used to construct a raw SQL query. WordPress provides $wpdb->prepare() for parameterized queries, but the plugin bypasses this mechanism. The handler is also registered without a capability check or nonce validation, making it callable by any anonymous HTTP client.

Attack Vector

Exploitation requires a single HTTP POST or GET request to admin-ajax.php with the plugin's AJAX action name and a crafted payload in the vulnerable parameter. No authentication, credentials, or user interaction are required. The attack is fully remote and can be automated across WordPress sites indexed by search engines or plugin fingerprinting tools.

For technical details on the payload structure and vulnerable parameter, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2026-87767

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing SQL syntax such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants in query parameters
Web server logs showing repeated admin-ajax.php requests from a single source with varying parameter payloads
Database error messages returned in HTTP responses when verbose error reporting is enabled
Unexpected read activity against wp_users, wp_usermeta, or wp_options tables in database query logs

Detection Strategies

Deploy Web Application Firewall (WAF) rules that identify SQL injection patterns targeting admin-ajax.php
Enable MySQL general query logging temporarily to identify anomalous UNION-based reads originating from the WordPress user
Monitor for HTTP response time anomalies consistent with time-based blind SQL injection
Correlate high-volume anonymous AJAX requests with subsequent authenticated logins from new IP addresses

Monitoring Recommendations

Ingest WordPress access logs and database query logs into a centralized SIEM for correlation and alerting
Alert on any HTTP request to admin-ajax.php where parameter values contain SQL keywords or comment sequences
Track outbound data volumes from web servers to identify bulk exfiltration following successful injection
Review installed WordPress plugin inventories against known-vulnerable component lists on a recurring schedule

How to Mitigate CVE-2026-87767

Immediate Actions Required

Deactivate and remove the WP Shortcut Link and Advertisement Baner plugin from all WordPress installations until a patched version is released
Rotate all WordPress administrator passwords and invalidate active sessions in case credentials were exfiltrated
Audit wp_users and wp_options for unauthorized modifications, injected administrator accounts, or altered siteurl values
Block requests to admin-ajax.php that contain SQL metacharacters at the WAF or reverse proxy layer

Patch Information

No vendor patch is referenced in the NVD entry or the WPScan Vulnerability Report at time of publication. All versions through 1.2.0 are affected. Administrators should monitor the WordPress plugin repository for an updated release and remove the plugin in the interim.

Workarounds

Uninstall the plugin entirely, as this is the only guaranteed mitigation without a vendor patch
Restrict access to admin-ajax.php for unauthenticated users through server-level rules where site functionality permits
Deploy WAF signatures that block SQL injection payloads targeting the plugin's AJAX action name
Enforce least-privilege database credentials for the WordPress user to limit the scope of data an attacker can read

bash

# Example nginx rule to block SQL keywords in admin-ajax.php requests
location = /wp-admin/admin-ajax.php {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|information_schema)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}