CVE-2026-9010

HighCVSS 7.5

Published: 20/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to 2.0.3. Insufficient escaping and lack of prepared statements allow unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive database information.

Risk Assessment

An unauthenticated attacker can exfiltrate sensitive data from the WordPress database, including user passwords and configuration details.

Recommendation

Update the Boost plugin to the latest available version that includes the security fix.

Other vulnerabilities in WordPress Boost plugin

CVE-2026-7637Critical
The Boost plugin for WordPress up to version 2.0.3 is vulnerable to PHP Object Injection via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

Original NVD description (English source)

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.