CVE-2026-8978 describes an SQL Injection vulnerability in the OptinCraft WordPress plugin affecting all versions up to and including 1.2.0. The issue arises from improper neutralization of special elements in the 'order_by' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated users with administrator privileges can exploit this to append malicious SQL queries, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 4.9 (medium severity). No patch or official fix has been documented by the vendor.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized reading of sensitive information from the database. The vulnerability does not impact integrity or availability directly, but compromises confidentiality. Since exploitation requires high privileges, the risk is limited to users who already have significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'order_by' parameter. Avoid using vulnerable plugin versions if possible.