CVE-2026-84068 describes a SQL injection vulnerability in the Quentn WP WordPress plugin prior to version 1.2.15. The flaw arises because the plugin does not adequately escape a request parameter before incorporating it into an SQL query without preparation. This allows unauthenticated attackers to perform SQL injection attacks to extract arbitrary data from the underlying database.

An unauthenticated attacker can exploit this vulnerability to extract arbitrary data from the database, potentially exposing sensitive information stored by the plugin or WordPress site. The vulnerability could lead to data disclosure but does not explicitly mention other impacts such as data modification or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that versions before 1.2.15 are affected, implying that upgrading to version 1.2.15 or later may remediate the issue. Until official confirmation, users should verify with the vendor if an official fix is available and apply it promptly.