EIP-2026-113617

PRE-CVE

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113617. PoCs published by Ibrahim Raafat.

AI-analyzed exploit summary The exploit details a SQL injection vulnerability in the Calculated Fields Form WordPress plugin (version <= 1.0.10). It provides URLs demonstrating SQLi via the 'u', 'name', 'c', and 'd' parameters, but lacks executable code.

Description

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

Exploits (1)

exploitdb WRITEUP

by Ibrahim Raafat · textwebappsphp

https://www.exploit-db.com/exploits/36230

View Code ZIP pw:eip

The exploit details a SQL injection vulnerability in the Calculated Fields Form WordPress plugin (version <= 1.0.10). It provides URLs demonstrating SQLi via the 'u', 'name', 'c', and 'd' parameters, but lacks executable code.

Classification

Writeup 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Calculated Fields Form WordPress Plugin <= 1.0.10

Auth required

Prerequisites: Admin access to WordPress dashboard · Plugin version <= 1.0.10 installed

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026