CVE-2026-95610: UpSolution Core Blind SQL Injection Flaw

CVE-2026-95610 Overview

CVE-2026-95610 is a Blind SQL Injection vulnerability in the UpSolution Core (us-core) WordPress plugin. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. All versions of UpSolution Core up to and including 9.3 are affected.

An authenticated attacker with low privileges can inject malicious SQL statements through vulnerable plugin inputs. Successful exploitation enables unauthorized data extraction from the WordPress database and crosses trust boundaries (scope change).

Critical Impact
Low-privileged attackers can exfiltrate sensitive database contents through blind SQL injection, bypassing application-level trust boundaries without user interaction.

Affected Products

UpSolution Core (us-core) plugin for WordPress
All versions from an unspecified starting release through 9.3
WordPress sites bundling the Impreza theme ecosystem that depends on us-core

Discovery Timeline

2026-10-09 - CVE-2026-95610 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-95610

Vulnerability Analysis

The vulnerability is a Blind SQL Injection in the UpSolution Core WordPress plugin. In a blind variant, the application does not return database errors or query output directly. Instead, attackers infer data by observing boolean responses or time-based delays in the HTTP response.

Because the issue carries a scope change, exploitation impact extends beyond the vulnerable component to the broader WordPress environment. The attacker needs only low-privilege authenticated access, which is achievable on sites allowing subscriber or contributor registration.

The vulnerability yields high confidentiality impact with limited availability impact. Integrity is reported as unaffected, suggesting read-oriented injection paths rather than write primitives.

Root Cause

The root cause is improper neutralization of special characters in user-controlled input that is concatenated into SQL statements. The plugin fails to apply prepared statements or parameterized queries through the WordPress $wpdb->prepare() API. Attacker-supplied values reach the database layer with SQL metacharacters intact.

Attack Vector

The attack vector is network-based through standard HTTP(S) requests to the WordPress site. An authenticated user submits crafted parameters to a vulnerable plugin endpoint. The injected payload alters query logic, enabling boolean-based or time-based blind extraction of database contents including user credentials, session tokens, and configuration secrets.

No verified public exploit code is available at publication. Technical details are referenced in the Patchstack advisory for UpSolution Core.

Detection Methods for CVE-2026-95610

Indicators of Compromise

HTTP requests to us-core plugin endpoints containing SQL metacharacters such as ', UNION, SLEEP(, BENCHMARK(, or AND 1=1
Repeated requests from the same authenticated session with incrementally changing parameter values indicating blind extraction
Unusual response time patterns on plugin endpoints consistent with time-based SQL injection probing
Database query logs containing malformed or unexpectedly long WHERE clauses originating from plugin code paths

Detection Strategies

Enable WordPress database query logging and alert on queries referencing wp_users or wp_usermeta from plugin contexts outside normal workflows
Deploy a web application firewall (WAF) with signatures tuned for blind SQL injection patterns against WordPress plugin URIs
Correlate authentication events with subsequent high-volume requests to us-core endpoints to identify low-privilege account abuse

Monitoring Recommendations

Monitor HTTP 200 responses with abnormal latency on us-core plugin routes to catch time-based injection
Track low-privilege account activity for repeated parameter manipulation and unusual request fan-out
Ingest WordPress and WAF logs into a centralized analytics platform to retain forensic evidence of injection attempts

How to Mitigate CVE-2026-95610

Immediate Actions Required

Upgrade UpSolution Core (us-core) to a version later than 9.3 as soon as the vendor publishes a fixed release
Audit WordPress user accounts and remove unused low-privilege accounts that could be leveraged for exploitation
Rotate database credentials, WordPress secret keys in wp-config.php, and administrator passwords if exploitation is suspected
Review database access logs for signs of unauthorized data extraction from sensitive tables

Patch Information

Refer to the Patchstack advisory for the current patch status. The advisory lists all versions through 9.3 as vulnerable. Site operators should subscribe to vendor update channels and apply the fixed release immediately upon availability.

Workarounds

Restrict registration and lock down low-privilege roles to limit the pool of authenticated accounts that can reach the vulnerable endpoint
Deploy a WAF rule to block requests to us-core endpoints containing SQL injection patterns until a patch is applied
Temporarily deactivate the UpSolution Core plugin on non-critical sites if business impact permits
Enforce least-privilege database users for WordPress to reduce the blast radius of successful injection

bash

# Example WAF rule (ModSecurity) to block common blind SQLi patterns on us-core endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/us-core/" \
    "id:1095610,phase:2,deny,status:403,log,\
    msg:'Blocked potential CVE-2026-95610 SQLi against UpSolution Core',\
    chain"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|'\s+or\s+1=1)" \
        "t:none,t:urlDecodeUni"