CVE-2026-66594: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in lukeseager WordPress Persistent Login

This vulnerability (CVE-2026-66594) is an SQL Injection flaw (CWE-89) in the WordPress Persistent Login plugin, versions up to and including 3.1.0. It allows a subscriber-level user to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with subscriber privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and may cause limited disruption to service availability (low availability impact). Integrity impact is not indicated.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber privileges where possible and monitor for unusual database activity related to the plugin.