CVE-2026-59515
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.
Risk Assessment
The risk involves unauthorized database access, potential data leakage, or data modification without administrator awareness.
Recommendation
Immediately update the AIWU plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Other vulnerabilities in AIWU
See all- CVE-2026-39801Critical
The AIWU plugin in versions up to and including 1.5.9 contains a privilege escalation vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
- CVE-2026-65507Critical
Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.
- CVE-2026-48879Critical
The AIWU WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.4.17.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS