CVE-2026-61966
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Subscriber SQL Injection vulnerability in WPJAM Basic versions up to 7.0.1. A user with subscriber role can execute arbitrary SQL queries.
Risk Assessment
Risk includes unauthorized access to the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Update the plugin to the latest patched version. Restrict subscriber privileges and monitor logs for suspicious queries.
Other vulnerabilities in WPJAM Basic
See all- CVE-2026-66432High
Subscriber Sensitive Data Exposure vulnerability in WPJAM Basic versions up to 7.0.2.1.
- CVE-2026-57372High
SSRF vulnerability in the WPJAM Basic plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 7.0.
- CVE-2026-57371High
The WPJAM Basic plugin version 7.0 and earlier contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Original NVD description (English source)
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS