CVE-2026-39475

HighCVSS 7.6

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

The User Feedback plugin for WordPress up to version 1.10.1 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

Risk Assessment

The risk is blind SQL injection, potentially allowing an attacker to extract sensitive data from the WordPress database.

Recommendation

Immediately update the User Feedback plugin to a version later than 1.10.1.

Other vulnerabilities in User Feedback

CVE-2026-39476Medium
The User Feedback plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.10.1.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.