This vulnerability (CVE-2026-94117) in DevItems HashBar – WordPress Notification Bar is caused by improper neutralization of special elements used in SQL commands, classified under CWE-89. It enables blind SQL injection attacks, which can allow an attacker with high privileges to extract sensitive information from the database (confidentiality impact) and cause partial denial of service (availability impact). The vulnerability affects all versions up to 2.0.3 inclusive. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change. No official patch or remediation details are provided in the available data.

An attacker with high privileges can exploit this vulnerability remotely without user interaction to perform blind SQL injection attacks. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted. The scope of the vulnerability is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Applying the principle of least privilege to limit access rights may reduce risk until a fix is available.