External risk intelligence

Crowd Favorite DXP ToolKit SQL Injection Vulnerability Affecting Versions Through 2.0.1

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-115607

The vulnerability affects a WordPress plugin. WordPress plugins are commonly deployed as part of public-facing web applications. Because these components are integral to the functionality of web sites accessible over the internet, the attack surface is considered likely to be internet-facing in standard deployment scenarios.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DXP ToolKit, a component used in web applications. This issue, known as SQL injection, could allow unauthorized access to or manipulation of data stored in databases if exploited. The primary concern is confirming whether our specific systems utilize this tool and are therefore exposed.

Allows unauthorized data access.
Could impact customer data confidentiality.
Verify relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted SQL commands to a web application using the affected DXP ToolKit component. This occurs because the software does not properly handle or sanitize these commands, allowing malicious input to be interpreted as part of a database query. Successful exploitation could allow an attacker to read sensitive information from the database or affect the availability of the application.

Accessible via the network.
Triggered by SQL injection.
Risk of data exposure or service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into the application's database. This may occur when the tool kit processes certain user-supplied input without proper sanitization, potentially leading to unauthorized access or modification of stored information.

Sensitive database data could be exposed.
Malicious SQL commands injected via input.
Unauthorized access to application data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the Crowd Favorite DXP ToolKit impacts applications using versions up to and including 2.0.1. Owners of affected WordPress sites, likely managed by platform or application teams, must first confirm if the DXP ToolKit is deployed and accessible externally. Prioritizing remediation efforts on internet-facing or business-critical instances will mitigate the highest risks.

Application owners should own the issue.
Verify external accessibility of the toolkit.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Crowd Favorite DXP ToolKit?

DXP ToolKit is a WordPress plugin designed to extend the capabilities of web applications. Developers use such toolkits to add specialized functionality or integrate features into their sites. It serves as a component within the content management system's architecture, helping to manage data or workflows.

What does SQL injection mean for CVE-2026-115607?

This vulnerability, classified as CWE-89, happens when software fails to clean user input before using it in a database query. Because the application cannot distinguish between legitimate data and malicious commands, an attacker can trick the database into running unintended instructions, potentially exposing sensitive information.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted SQL commands through input fields processed by the DXP ToolKit. The bug is specifically tied to the processing of unsanitized user-supplied data. It is not triggered by standard site navigation or interactions that do not involve submitting malicious or unexpected input strings to the affected functions.

Is my site relevant to this CVE?

If you use the affected DXP ToolKit on a WordPress site, you should evaluate your risk. Halo Surface Signal notes that since WordPress plugins are core parts of web applications, they are often reachable over the internet. You should determine if your specific instance is internet-facing, as this increases the likelihood that it could be reached by an external actor.

What are the first steps to address this issue?

Start by identifying if your WordPress environment has the DXP ToolKit installed and if it is running version 2.0.1 or older. Once identified, prioritize checking these instances for external connectivity. Since this is a critical security concern, focus your immediate review on sites that handle sensitive data or are critical to your operations.

References

patchstack.com/database/wordpress/plugin/dxp-toolkit/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.