CVE-2026-5028 is a SQL Injection vulnerability in the Eight Day Week Print Workflow plugin for WordPress, affecting all versions up to 1.2.6. The flaw exists in the handling of the 'title' parameter in the pp-get-articles AJAX action, where insufficient escaping and lack of prepared statements allow authenticated users with Subscriber-level privileges or higher to perform time-based blind SQL Injection attacks. This enables attackers to append additional SQL commands to existing queries and potentially extract sensitive information from the database. The vulnerability does not affect availability or integrity but impacts confidentiality. No vendor patch or official remediation has been published as of the data provided.

An attacker with at least Subscriber-level access can exploit this vulnerability to perform time-based blind SQL Injection, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect system availability or data integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to the pp-get-articles AJAX action. Avoid exposing this plugin on publicly accessible sites if possible.