CVE-2026-66446

The If-So Dynamic Content Personalization plugin versions up to 1.10 contain a Subscriber SQL Injection vulnerability. An attacker with a subscriber account can send specially crafted queries that can manipulate the database.

An attacker with subscriber privileges can read, modify, or delete data from the database, potentially leading to confidentiality, integrity, and availability breaches. This may also enable privilege escalation or site takeover.

Update the If-So Dynamic Content Personalization plugin to the latest version that includes the fix. If not available, restrict subscriber privileges and monitor database logs for suspicious queries.