CVE-2026-32555: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in PixelYourSite Professional Boost

This vulnerability (CVE-2026-32555) involves improper neutralization of special elements used in an SQL command (CWE-89) in PixelYourSite Professional Boost plugin versions <= 2.0.4. It allows unauthenticated attackers to perform SQL Injection attacks remotely, which can compromise the confidentiality of the database and cause limited availability issues. The CVSS 3.1 base score is 9.3, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. No known exploits are reported in the wild, and no official patch or remediation level has been published yet.

The vulnerability allows unauthenticated remote attackers to inject SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The attack requires no privileges or user interaction and can be executed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin component if possible to mitigate risk.