CVE-2026-66649: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in e-plugins Directory Pro

This vulnerability (CVE-2026-66649) is an improper neutralization of special elements used in an SQL command (CWE-89) in e-plugins Directory Pro, specifically versions up to 2.5.8. It allows unauthenticated attackers to perform SQL Injection attacks, which can compromise the confidentiality of the database and cause limited denial of service. The CVSS v3.1 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. The impact includes high confidentiality loss and low availability impact, with no integrity impact.

The vulnerability enables unauthenticated remote attackers to execute arbitrary SQL commands on the backend database, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to service availability (low availability impact). There is no reported impact on data integrity. This could lead to data leakage or partial denial of service conditions.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying temporary mitigations such as restricting access to the vulnerable application or using web application firewalls to detect and block SQL injection attempts.