CVE-2026-82227: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in VillaTheme WPBulky

CVE-2026-82227 is an SQL Injection vulnerability (CWE-89) in the WPBulky plugin by VillaTheme, affecting versions up to 1.2.2. The issue arises from improper neutralization of special elements in SQL commands related to the Contributor feature, allowing an attacker with low privileges to execute crafted SQL commands remotely. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality with a high impact and availability with a low impact, but does not affect integrity. There is no vendor advisory or patch available at this time.

An attacker with low privileges can exploit this vulnerability remotely to execute unauthorized SQL commands, potentially leading to high confidentiality impact such as unauthorized data disclosure. The integrity of data is not impacted, and availability impact is low. This could allow exposure of sensitive information stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor privileges and monitor for suspicious activity related to SQL queries. Avoid exposing the vulnerable functionality to untrusted users where possible.