CVE-2026-5028 is a SQL Injection vulnerability (CWE-89) in the Eight Day Week Print Workflow WordPress plugin affecting versions up to 1.2.6. The issue arises from improper neutralization of special elements in the 'title' parameter used in the pp-get-articles AJAX action, enabling time-based blind SQL Injection attacks. Authenticated attackers with low privileges (Subscriber-level) can append SQL queries to extract sensitive data from the backend database. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated user with Subscriber-level privileges or higher to perform time-based blind SQL Injection, potentially extracting sensitive information from the database. The vulnerability does not impact data integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to the pp-get-articles AJAX action. Avoid using the vulnerable plugin version in sensitive environments.