CVE-2026-93000: SPS-Suite WordPress Plugin SQL Injection

CVE-2026-93000 Overview

CVE-2026-93000 is a SQL injection vulnerability in the SPS-Suite WordPress plugin through version 1.4.0. The plugin fails to sanitize the search query parameter before passing it to a SQL statement when the static-page search feature is enabled. Unauthenticated attackers can exploit this flaw remotely over the network to inject arbitrary SQL and extract sensitive database contents. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated SQL injection allowing attackers to read sensitive WordPress database contents, including user credentials and configuration data.

Affected Products

SPS-Suite WordPress plugin versions up to and including 1.4.0
WordPress installations with the SPS-Suite static-page search feature enabled
Any site exposing the vulnerable search endpoint to unauthenticated users

Discovery Timeline

2026-09-28 - CVE CVE-2026-93000 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-93000

Vulnerability Analysis

The vulnerability resides in the SPS-Suite plugin's static-page search handler. When this feature is enabled, the plugin accepts a user-supplied search term and concatenates it directly into a SQL query without parameterization or input sanitization. An unauthenticated attacker can submit a crafted search request containing SQL control characters and operators to alter query logic.

The attack complexity is elevated because exploitation requires the static-page search feature to be active, which is not the default state. However, when enabled, the endpoint is reachable without authentication, giving remote attackers direct access to the vulnerable code path.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The plugin's search handler constructs database queries through string concatenation rather than using prepared statements or the WordPress $wpdb->prepare() API. Any single quote, union operator, or comment sequence supplied in the search parameter is interpreted as SQL syntax by the backend MySQL/MariaDB engine.

Attack Vector

An unauthenticated attacker sends an HTTP request to the search endpoint of a WordPress site running SPS-Suite with the static-page search feature enabled. The attacker crafts the search parameter with SQL payloads such as UNION-based or boolean-blind injection patterns to extract data from arbitrary tables. Successful exploitation can disclose administrator password hashes stored in wp_users, secret keys in wp_options, and session tokens.

See the WPScan Vulnerability Report for additional technical context on the vulnerable code path.

Detection Methods for CVE-2026-93000

Indicators of Compromise

HTTP request logs containing SQL metacharacters (single quotes, UNION SELECT, --, /*) in search query parameters directed at SPS-Suite endpoints.
Unexpected database errors or stack traces appearing in web server logs tied to the plugin's search functionality.
Anomalous outbound queries from the WordPress host reading from wp_users or wp_options tables outside normal admin workflows.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting WordPress search parameters.
Enable MySQL general query logging temporarily to identify malformed or union-based queries originating from the plugin.
Monitor WordPress access logs for high-volume search requests from single IP addresses, a common pattern in automated SQLi tooling such as sqlmap.

Monitoring Recommendations

Alert on HTTP 500 responses or elevated query latency on URLs invoking the SPS-Suite search handler.
Correlate web request telemetry with database audit logs to detect SELECT statements referencing authentication tables from unexpected sources.
Review file integrity on wp-content/plugins/sps-suite/ to detect post-exploitation webshell drops.

How to Mitigate CVE-2026-93000

Immediate Actions Required

Disable the static-page search feature in the SPS-Suite plugin configuration until a patched version is installed.
Deactivate the SPS-Suite plugin entirely if the search feature cannot be disabled independently.
Audit the WordPress database for unauthorized administrator accounts, modified options, and suspicious user metadata.
Rotate all WordPress administrator passwords and secret keys defined in wp-config.php.

Patch Information

No fixed version is referenced in the published advisory at the time of writing. The vulnerability affects SPS-Suite through 1.4.0. Monitor the WPScan Vulnerability Report and the WordPress plugin repository for an updated release addressing the flaw.

Workarounds

Block requests to the SPS-Suite search endpoint at the WAF or reverse proxy layer using signature-based SQLi protections.
Restrict access to the search functionality by IP allowlist where business requirements permit.
Place the vulnerable site behind an authenticated gateway if the static-page search feature must remain operational.

bash

# Example WAF rule (ModSecurity) to block SQL metacharacters in search queries
SecRule ARGS:search "@rx (?i)(union(.*?)select|select(.*?)from|--|/\*|')" \
    "id:1009300,phase:2,deny,status:403,msg:'SPS-Suite SQLi attempt (CVE-2026-93000)'"