CVE-2026-73998
HighCVSS 8.5Summary
SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.
Risk Assessment
Risk of unauthorized access to database data, modification or deletion, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the WP w3all phpBB plugin to the latest version that includes a fix eliminating the SQL Injection vulnerability.
Other vulnerabilities in WP w3all phpBB
See all- CVE-2026-107422Medium
The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-78293High
Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.
Original NVD description (English source)
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS