CVE-2026-8978 is an SQL Injection vulnerability in the OptinCraft WordPress plugin affecting versions prior to 1.2.1. The issue arises from improper neutralization of special elements in the 'order_by' parameter, allowing authenticated administrators to append malicious SQL commands to existing queries. This can lead to unauthorized extraction of sensitive database information. The vulnerability requires high privileges (administrator) and does not affect availability or integrity, only confidentiality. No vendor advisory or patch information is currently available.

An attacker with administrator-level access can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. This compromises the confidentiality of the data stored by the plugin but does not impact data integrity or availability. The attack requires authenticated access with high privileges, limiting the attack surface to trusted users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'order_by' parameter. Avoid using vulnerable versions and consider disabling or replacing the plugin if possible.