Cve-2026-120043 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-120043/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 05:59:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSliceWP Affiliates: SQL injection in email parameter (CVE-2026-120043)https://feed.craftedsignal.io/briefs/2026-11-slicewp-sql-injection/Sat, 07 Nov 2026 05:59:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-slicewp-sql-injection/An unauthenticated SQL injection vulnerability in SliceWP Affiliates versions 1.2.14 and earlier allows remote attackers to extract sensitive database information via the email parameter during WooCommerce registration.CVE-2026-120043 is a SQL injection vulnerability within the SliceWP Affiliates plugin for WordPress. The flaw exists in the handling of the 'email' parameter due to insufficient input escaping and lack of parameterized queries. The vulnerability is reachable without authentication via the 'user_register' hook, which is triggered during WooCommerce user account creation. Successful exploitation allows an attacker to append arbitrary SQL queries to the backend database, potentially resulting in unauthorized data access.

Impact

Unauthenticated remote attackers can perform arbitrary SQL queries against the underlying WordPress database, leading to the potential exposure of sensitive application data.

Recommendation

  • Upgrade the SliceWP Affiliates plugin to a version released after 1.2.14 that includes the fix for CVE-2026-120043.
  • Until patching is possible, monitor WooCommerce registration traffic for anomalous 'email' parameter values containing SQL control characters or keywords.
  • Audit database access logs for queries originating from the application layer that deviate from the expected baseline, particularly those involving unexpected UNION or OR statements.
]]>highadvisorywordpresssql-injectionweb-applicationcve-2026-120043