CVE-2026-96329: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in tagDiv tagDiv Opt-In Builder

This vulnerability arises from improper neutralization of special elements in SQL commands within the tagDiv Opt-In Builder plugin's td-subscription feature. It enables blind SQL injection, allowing an attacker to infer database information by sending crafted requests. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The affected versions are all versions prior to 1.7.7.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive database information. The vulnerability impacts confidentiality severely, with limited impact on availability and no impact on integrity. No known exploits are reported in the wild at this time.

No vendor advisory or patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable component and monitor for suspicious activity related to SQL injection attempts.