CVE-2026-79621: CWE-345 Insufficient Verification of Data Authenticity in CatalogX
Description
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
CVSS v3.1
Score 4.3medium
Affected software
CatalogX
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The CatalogX WordPress plugin prior to version 6.1.3 fails to properly sanitize or escape content that unauthenticated users can store. This content is later included in product enquiry notification emails sent to site administrators when other visitors submit enquiries. This insufficient verification of data authenticity (CWE-345) enables unauthenticated attackers to inject arbitrary content into these emails, potentially misleading administrators or causing confusion. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no required privileges but limited impact (integrity only, no confidentiality or availability impact).
Potential Impact
An attacker can inject arbitrary content into product enquiry notification emails sent to site administrators, which could lead to misinformation or social engineering risks. There is no direct impact on data confidentiality or system availability.
Mitigation Recommendations
No official patch or remediation level is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when interpreting product enquiry emails and consider additional validation or filtering of email content.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-25T08:35:51.210Z
- State
- PUBLISHED
Threat ID: 6a97bd35acd9273b49d9bc0b
Added to database: 09/02/2026, 06:07:49 UTC
Last enriched: 09/07/2026, 14:06:43 UTC
Last updated: 10/18/2026, 06:48:20 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.