External risk intelligence

WPJAM Basic Subscriber SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61966

The vulnerability exists in a WordPress plugin. WordPress plugins are typically deployed as part of public-facing web applications, making the code paths within them commonly reachable via the internet as part of the standard web server request processing flow.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in a widely used WordPress plugin, potentially exposing sensitive data and allowing unauthorized access. This issue could impact any organization utilizing this plugin without proper mitigation, necessitating a review of its presence and the security of associated data. The primary concern is to confirm whether this plugin is in use and, if so, to understand the potential exposure.

Unauthenticated code allows database compromise.
Affects common website technology, widespread use.
Confirm usage; assess potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL queries to a vulnerable WordPress site that uses the WPJAM Basic plugin. This could happen over the network without requiring any prior authentication. If successful, the attacker could gain unauthorized access to sensitive subscriber data and potentially disrupt the site's operations.

No authentication needed to start.
SQL injection via crafted queries.
Risk of data access and disruption.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in WPJAM Basic could allow unauthenticated attackers to execute arbitrary SQL commands on the underlying database. This could potentially lead to the exposure of sensitive subscriber information when the plugin is used in supported environments.

Subscriber data.
Via unauthenticated network requests.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in WPJAM Basic could allow unauthenticated attackers to access sensitive data. Application owners and infrastructure teams should collaborate to identify affected WordPress sites, assess their exposure, and plan remediation. The first step is to determine the presence of the plugin and confirm its reachability.

Ownership: Application owners and infrastructure teams.
Verify first: Plugin presence and external reachability.
Action: Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WPJAM Basic?

WPJAM Basic is a WordPress plugin designed to optimize and manage various aspects of a WordPress site. It provides developers and administrators with a suite of tools for site performance and backend administration, often used to streamline site maintenance or enhance site-wide functionality.

What does SQL injection mean for CVE-2026-61966?

This vulnerability, classified as CWE-89, occurs when software fails to properly sanitize user input before including it in a database query. In this case, it allows an attacker to inject their own malicious SQL commands into the plugin's operations, potentially tricking the database into revealing or altering information it should keep private.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically formatted network requests to a site running the affected plugin versions. Because it does not require authentication, the attacker does not need a user account or special permissions on the website to initiate the request; the bug exists within the plugin's public-facing data handling logic.

Who should be concerned about this CVE?

Anyone managing websites using the WPJAM Basic plugin should be concerned. Halo Surface Signal indicates that because this is a WordPress plugin, it is commonly part of public-facing web applications reachable over the internet. If your site is accessible online, the vulnerable code path is likely exposed to remote attackers.

How do I respond to this threat?

Your first step is to perform an inventory of your WordPress environments to identify if WPJAM Basic is installed and which version is in use. Once identified, evaluate the plugin's external reachability. Coordinate with your team to determine if an update is available or if the plugin must be disabled or replaced to secure your database.

References

patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.