CVE-2026-42712

HighCVSS 8.5

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

SQL Injection vulnerability in the Qode Tours plugin in versions up to 3.1.3.2, affecting users with the subscriber role.

Risk Assessment

A user with the subscriber role can exploit this vulnerability to manipulate SQL queries, potentially leading to unauthorized data access or modification.

Recommendation

Update the Qode Tours plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Qode Tours

CVE-2026-65546Critical
Unauthenticated SQL Injection in Qode Tours versions up to 3.1.3.1.

Original NVD description (English source)

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS