EIP-2026-114077

PRE-CVE

WordPress Plugin SP Project & Document Manager 2.5.3 - Blind SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114077. PoCs published by Catsecurity.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in WordPress SP Project & Document Manager 2.5.3. The 'pid' parameter in the 'thumbnails' function is not sanitized, allowing unauthorized users to execute SQL queries.

Description

WordPress Plugin SP Project & Document Manager 2.5.3 - Blind SQL Injection

Exploits (1)

exploitdb WORKING POC

by Catsecurity · textwebappsphp

https://www.exploit-db.com/exploits/36576

View Code ZIP pw:eip

This exploit demonstrates a blind SQL injection vulnerability in WordPress SP Project & Document Manager 2.5.3. The 'pid' parameter in the 'thumbnails' function is not sanitized, allowing unauthorized users to execute SQL queries.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: WordPress SP Project & Document Manager 2.5.3 and previous versions

No auth needed

Prerequisites: WordPress installation with SP Project & Document Manager plugin version 2.5.3 or earlier

MITRE ATT&CK

T1189 - Drive-by Compromise

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026