CVE-2026-28168 is an SQL Injection vulnerability (CWE-89) in CubeWP, a product by Imran Tauqeer. It affects versions up to 1.1.30 and allows an attacker with network access and low privileges to inject SQL commands via the Subscriber feature. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact is high confidentiality loss and low availability impact. There is no vendor advisory or patch information available at this time.

An attacker can exploit this SQL Injection vulnerability remotely with low complexity and no user interaction, potentially leading to significant confidentiality breaches and limited availability disruption. Integrity impact is not indicated. The scope of the vulnerability is changed, meaning the attack can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the vulnerable functionality and monitoring for suspicious activity related to SQL injection attempts.