Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access… (CVE-2026-95605)

The vulnerability identified as CVE-2026-95605 is an improper neutralization of special elements used in an SQL command (SQL Injection) in the Passionate Programmer Peter WP Data Access plugin. This flaw allows an attacker to perform blind SQL injection attacks, which can lead to unauthorized disclosure of information (high confidentiality impact) and partial denial of service (low availability impact). The vulnerability affects all versions up to 5.5.82. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information due to blind SQL injection. The CVSS score of 9.3 indicates a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. The impact on confidentiality is high, integrity is not affected, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the affected plugin and monitoring for suspicious activity related to SQL injection attempts.