CVE-2026-3781 describes an SQL Injection vulnerability in the Attendance Manager plugin for WordPress, affecting all versions up to 0.6.2. The vulnerability arises from improper neutralization of special elements in the 'attmgr_off' parameter, which is insufficiently escaped and prepared in SQL queries. Authenticated attackers with Subscriber-level privileges can append malicious SQL code to existing queries, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 5.4 (medium severity). No official patch or remediation level has been provided by the vendor as of the published date.

Exploitation of this vulnerability allows authenticated users with low-level privileges (Subscriber and above) to perform SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information stored in the database. The impact is limited to confidentiality loss; integrity and availability impacts are not indicated. There are no known active exploits in the wild, reducing immediate risk but not eliminating potential future exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict Subscriber-level access where possible and monitor for suspicious activity related to the 'attmgr_off' parameter. Avoid using the vulnerable plugin version or consider disabling the plugin if feasible. Follow up with the vendor for updates on patches or official mitigations.