CVE-2026-6453 | BDVDB-2026-354495 Detail
cubewp1211CubeWP Framework
Description#
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References#
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647620-e06a-49d5-8f9d-a59cb5a999b1?source=cve
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/functions/admin-functions.php#L2655
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L261
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L261
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L251
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L251
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/functions/admin-functions.php#L2655
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3627740%40cubewp-framework&new=3627740%40cubewp-framework
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.