The Apocalypse Meow plugin for WordPress suffers from an SQL Injection vulnerability identified as CVE-2026-3523, classified under CWE-89. The root cause is a flawed logical operator in the validation of the 'type' parameter within ajax.php. Specifically, the condition uses a logical AND (&&) instead of OR (||), causing the in_array() check to be bypassed for any non-empty 'type' value. Additionally, the function stripslashes_deep() is called, which removes protections provided by wp_magic_quotes(), allowing single quotes to pass unescaped into the SQL query constructed on line 298. This combination enables an authenticated attacker with Administrator or higher privileges to append arbitrary SQL commands to existing queries. The vulnerability allows unauthorized reading of sensitive database information, compromising confidentiality. The CVSS 3.1 score is 4.9 (medium), reflecting the requirement for high privileges and the lack of impact on integrity or availability. No public exploits have been reported, but the vulnerability is present in all versions up to 22.1.0. The absence of a patch link indicates that a fix may not yet be available or publicly released.

This vulnerability primarily impacts the confidentiality of data stored in WordPress sites using the Apocalypse Meow plugin. An attacker with Administrator access can exploit the SQL Injection to extract sensitive information from the database, such as user credentials, personal data, or configuration details. While the vulnerability does not affect data integrity or site availability, the exposure of confidential data can lead to further attacks, including privilege escalation or targeted phishing. Organizations relying on this plugin risk data breaches, regulatory non-compliance, and reputational damage. Since exploitation requires high-level privileges, the threat is mitigated somewhat by existing access controls, but insider threats or compromised admin accounts could leverage this flaw. The lack of known exploits reduces immediate risk but does not eliminate it, especially as attackers may develop exploits once the vulnerability is public.

Organizations should immediately audit their WordPress sites for the presence of the Apocalypse Meow plugin and verify the version in use. Until a patch is released, restrict Administrator-level access to trusted personnel only and monitor admin activities for suspicious behavior. Employ Web Application Firewalls (WAFs) with custom rules to detect and block anomalous SQL query patterns targeting the 'type' parameter in ajax.php. Consider disabling or removing the plugin if it is not essential. Regularly back up databases and implement strict access controls to minimize the impact of potential exploitation. Once a patch becomes available, apply it promptly. Additionally, review and harden input validation logic in custom plugins to prevent similar logical operator errors. Enable logging and alerting for SQL errors or unusual database queries to detect exploitation attempts early.