This vulnerability (CVE-2026-66594) is an instance of improper neutralization of special elements used in an SQL command (CWE-89) in the WordPress Persistent Login plugin by lukeseager. It affects versions up to and including 3.1.0. The flaw allows an attacker with low privileges (subscriber role) to perform SQL injection attacks, which can compromise the confidentiality of the database. The CVSS v3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, privileges required at low level, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation is currently documented.

An attacker with subscriber-level privileges can exploit this SQL injection vulnerability to access or exfiltrate sensitive data from the database, impacting confidentiality. The vulnerability does not affect data integrity but may cause limited availability issues. The scope of the impact extends beyond the vulnerable component, indicating potential broader system impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted users.