{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/slicewp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:slicewp:slicewp_affiliates:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120043"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SliceWP Affiliates (\u003c= 1.2.14)"],"_cs_severities":["high"],"_cs_tags":["wordpress","sql-injection","web-application","cve-2026-120043"],"_cs_type":"advisory","_cs_vendors":["SliceWP"],"content_html":"\u003cp\u003eCVE-2026-120043 is a SQL injection vulnerability within the SliceWP Affiliates plugin for WordPress. The flaw exists in the handling of the 'email' parameter due to insufficient input escaping and lack of parameterized queries. The vulnerability is reachable without authentication via the 'user_register' hook, which is triggered during WooCommerce user account creation. Successful exploitation allows an attacker to append arbitrary SQL queries to the backend database, potentially resulting in unauthorized data access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthenticated remote attackers can perform arbitrary SQL queries against the underlying WordPress database, leading to the potential exposure of sensitive application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the SliceWP Affiliates plugin to a version released after 1.2.14 that includes the fix for CVE-2026-120043.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, monitor WooCommerce registration traffic for anomalous 'email' parameter values containing SQL control characters or keywords.\u003c/li\u003e\n\u003cli\u003eAudit database access logs for queries originating from the application layer that deviate from the expected baseline, particularly those involving unexpected UNION or OR statements.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:59:49Z","date_published":"2026-11-07T05:59:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-slicewp-sql-injection/","summary":"An unauthenticated SQL injection vulnerability in SliceWP Affiliates versions 1.2.14 and earlier allows remote attackers to extract sensitive database information via the email parameter during WooCommerce registration.","title":"SliceWP Affiliates: SQL injection in email parameter (CVE-2026-120043)","url":"https://feed.craftedsignal.io/briefs/2026-11-slicewp-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - SliceWP","version":"https://jsonfeed.org/version/1.1"}