CVE-2026-28168

HighCVSS 8.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.

Risk Assessment

The risk includes unauthorized access to the database, potentially leading to data leakage or modification.

Recommendation

Update the CubeWP plugin to a version newer than 1.1.30 that includes a fix for the SQL Injection vulnerability.

Original NVD description (English source)

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.