CVE-2026-8978: OptinCraft WordPress Plugin SQLi Vulnerability

CVE-2026-8978 Overview

CVE-2026-8978 is a SQL injection vulnerability affecting the OptinCraft – Drag & Drop Optins & Popup Builder for WordPress plugin. The flaw resides in the order_by parameter, which is processed without sufficient escaping or query preparation. All versions up to and including 1.2.0 are affected. Authenticated attackers with administrator-level access can append additional SQL queries to existing database statements. Successful exploitation allows extraction of sensitive information from the WordPress database. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated administrators can exfiltrate sensitive database contents through SQL injection in the order_by parameter of the OptinCraft plugin.

Affected Products

OptinCraft – Drag & Drop Optins & Popup Builder for WordPress (all versions through 1.2.0)
WordPress installations using the OptinCraft plugin
Sites running OptinCraft version 1.0.2 (referenced in source code analysis)

Discovery Timeline

2026-06-06 - CVE-2026-8978 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-8978

Vulnerability Analysis

The vulnerability exists in the OptinCraft campaign management flow. The CampaignController accepts a user-supplied order_by parameter and forwards it to the CampaignRepository. The repository passes the value into the underlying wpmvc query compiler without parameterization. Because the order_by clause is concatenated directly into the SQL statement, the database engine interprets attacker-controlled tokens as query syntax rather than data.

SQL ORDER BY clauses cannot be bound through standard prepared statement placeholders, which makes them a recurring source of injection when developers omit explicit allow-listing. The OptinCraft compiler at vendor/vendor-src/wpmvc/database/src/Query/Compilers/Compiler.php performs no validation against a list of permitted column names. Attackers can inject sub-queries, UNION SELECT statements, or conditional payloads to read arbitrary tables, including wp_users and wp_options.

Root Cause

The root cause is insufficient input sanitization and lack of parameter preparation on the order_by query parameter. The plugin trusts request input for SQL clause construction. No allow-list restricts the column name to known schema values, and no escaping function neutralizes SQL metacharacters before concatenation.

Attack Vector

Exploitation requires administrator-level authentication on the target WordPress site. The attacker sends a crafted request to the campaign listing endpoint with a malicious order_by value. The injected SQL is appended to the legitimate query and executed against the WordPress database. The attack is performed over the network and requires no user interaction once credentials are obtained.

// Vulnerable pattern (described in prose - no synthetic PoC)
// CampaignController receives $_GET['order_by'] and forwards it to
// CampaignRepository, which concatenates the value into an ORDER BY
// clause compiled by the wpmvc Query Compiler without binding.
// Refer to the Wordfence advisory and trac sources for full detail.

Detection Methods for CVE-2026-8978

Indicators of Compromise

HTTP requests to OptinCraft admin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK inside the order_by parameter
Unexpected administrator session activity targeting campaign management URLs
Database error messages or unusually long query response times correlated with admin-area traffic
WordPress audit log entries showing administrator accounts accessing the OptinCraft campaign listing repeatedly with varying parameter values

Detection Strategies

Inspect web server access logs for order_by values that contain characters such as (, ,, --, or whitespace beyond a single column token
Deploy a Web Application Firewall (WAF) rule set that flags SQL syntax inside WordPress admin query string parameters
Correlate administrator login events with subsequent anomalous query patterns hitting the plugin endpoints

Monitoring Recommendations

Enable MySQL general or slow query logging on staging or canary nodes to surface malformed ORDER BY clauses
Monitor for spikes in failed administrator authentication attempts that may indicate credential targeting prior to exploitation
Track plugin file integrity and version state through WordPress management tooling to confirm patched releases are deployed

How to Mitigate CVE-2026-8978

Immediate Actions Required

Update the OptinCraft plugin to a version released after 1.2.0 that addresses the order_by injection
Audit WordPress administrator accounts and rotate credentials for any account that may have been compromised
Review the WordPress changeset published by the vendor at WordPress Changeset Review to confirm the fix is present

Patch Information

The vendor published a corrective changeset for the OptinCraft plugin via the WordPress plugin repository. Administrators should upgrade to the latest available release through the WordPress dashboard or by replacing plugin files directly. Refer to the Wordfence Vulnerability Report and the WordPress CampaignRepository Source for verification details.

Workarounds

Restrict administrator access to trusted IP ranges using WordPress access control or reverse-proxy rules until patching is complete
Disable or remove the OptinCraft plugin on sites where the popup builder is not actively required
Enforce multi-factor authentication for all WordPress administrator accounts to reduce the likelihood of credential misuse
Deploy a WAF rule that blocks SQL metacharacters in the order_by parameter on plugin admin endpoints

bash

# Example WAF filter (ModSecurity-style) to block SQL syntax in order_by
SecRule ARGS:order_by "@rx (?i)(union|select|sleep|benchmark|--|/\*|;)" \
    "id:1026897801,phase:2,deny,status:403,msg:'OptinCraft order_by SQLi attempt (CVE-2026-8978)'"