EIP-2026-113557

PRE-CVE

WordPress Plugin All In One WP Security & Firewall 3.9.0 - SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113557. PoCs published by Claudio Viviani.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in WordPress All In One WP Security & Firewall 3.9.0. The PoC leverages improper sanitization of the 'orderby' parameter in multiple admin pages, allowing an attacker to inject malicious SQL queries.

Description

WordPress Plugin All In One WP Security & Firewall 3.9.0 - SQL Injection

Exploits (1)

exploitdb WORKING POC

by Claudio Viviani · textwebappsphp

https://www.exploit-db.com/exploits/36671

View Code ZIP pw:eip

This exploit demonstrates a blind SQL injection vulnerability in WordPress All In One WP Security & Firewall 3.9.0. The PoC leverages improper sanitization of the 'orderby' parameter in multiple admin pages, allowing an attacker to inject malicious SQL queries.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: WordPress All In One WP Security & Firewall 3.9.0

Auth required

Prerequisites: Access to WordPress admin panel · Vulnerable version of the plugin installed

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026