CVE-2026-96346 is an SQL Injection vulnerability (CWE-89) in the WP ERP plugin for WordPress, affecting versions up to 1.17.9. The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with high privileges to execute arbitrary SQL commands. The CVSS 3.1 score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, and no user interaction required. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits in the wild or patch information is provided.

An attacker with high privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). There is no integrity impact reported. The vulnerability requires high privileges to exploit and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to SQL queries in WP ERP. Avoid exposing the affected versions to untrusted networks.