CVE-2026-65526 is an SQL Injection vulnerability (CWE-89) in Themeisle Visualizer plugin versions up to 4.0.6. The issue arises from improper neutralization of special elements used in SQL commands, enabling an attacker with contributor privileges to inject arbitrary SQL. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No patch or official remediation level has been published, and no known exploits have been reported.

Successful exploitation could allow an attacker with contributor-level access to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability issues. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for unusual database activity related to the Visualizer plugin. Avoid exposing the affected plugin to untrusted users where possible.