CVE-2026-73998

HighCVSS 8.5

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

Risk Assessment

Risk of unauthorized access to database data, modification or deletion, potentially leading to confidentiality and integrity breaches.

Recommendation

Update the WP w3all phpBB plugin to the latest version that includes a fix eliminating the SQL Injection vulnerability.

Other vulnerabilities in WP w3all phpBB

CVE-2026-78293High
Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.

Original NVD description (English source)

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.