SQL Injection in Readabler Plugin for WordPress

The Readabler plugin for WordPress contains an unauthenticated SQL injection vulnerability (CVE-2026-78576) affecting all versions prior to 2.0.18. The flaw exists due to improper input sanitization and a lack of parameterized queries when handling user-supplied parameters. Because the vulnerability is reachable without authentication, remote, unauthenticated attackers can manipulate SQL queries executed by the application. Successful exploitation enables the exfiltration of sensitive information from the site's database, posing a high risk to data confidentiality. Organizations utilizing the Readabler plugin are advised to verify their installed version and upgrade to 2.0.18 or higher to remediate this vulnerability.

Impact

Successful exploitation allows unauthenticated attackers to perform SQL injection attacks, leading to unauthorized access to sensitive database information. This may include user credentials, configuration details, or other private data stored within the WordPress database. Given the ubiquity of WordPress installations, this vulnerability represents a significant risk for organizations managing public-facing web infrastructure.

Recommendation

• Update the Readabler plugin for WordPress to version 2.0.18 or later immediately.
• Audit web server access logs for anomalous HTTP requests containing SQL keywords (e.g., SELECT, UNION, SLEEP) targeting WordPress plugin endpoints.
• Deploy the Sigma rule provided below to monitor for potential SQL injection patterns targeting web applications.