CVE-2026-39581: WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the WP Sessions Time Monitoring Full Automatic WordPress plugin, affecting all versions up to and including 1.1.4. The flaw is reachable over the network and requires only a low-privilege account (such as a standard WordPress subscriber) to exploit, with no additional user interaction needed. Successful exploitation gives an attacker read access to the WordPress database contents and can also cause minor service disruption. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can send crafted HTTP requests to the WordPress installation without needing local or physical access.

• AuthenticationRequired

  A low-privilege WordPress account (such as a subscriber-level user) is sufficient; no administrative credentials are needed, but some authenticated session is required.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user; the injection can be triggered directly through the attacker's own requests.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
• Confidential content such as private posts, user metadata, and any data stored by other plugins is exposed to the attacker.
• The availability impact is partial; the attacker can cause degraded database performance or minor disruption to the affected WordPress service through repeated injected queries.
• The scope token is Changed (S:C), meaning the impact can extend beyond the plugin itself to other components sharing the same database, such as other WordPress plugins or the core application.