CVE-2026-96330: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in tagDiv tagDiv Opt-In Builder

The vulnerability identified as CVE-2026-96330 involves improper neutralization of special elements used in SQL commands within the tagDiv Opt-In Builder plugin, specifically in the td-subscription component. This flaw enables Blind SQL Injection attacks, which can be exploited remotely without authentication. The CVSS v3.1 score of 9.3 reflects a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The affected versions include all releases from initial up to version 1.7.6 inclusive.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). There is no reported impact on data integrity. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to vulnerable components and applying web application firewall (WAF) rules to detect and block SQL injection attempts.