CVE-2026-54809: WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10.
Metrics
- CVSS v3.1
- 9.3
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
A SQL injection vulnerability in the VillaTheme GIFT4U WordPress plugin (versions 1.0.10 and earlier) allows an unauthenticated attacker to reach it over the network without any credentials. Specifically, the plugin fails to sanitize user input before passing it to database queries, enabling blind SQL injection. Successful exploitation reads data from the underlying database, including stored user records and sensitive application data, and can cause limited service disruption to the affected WordPress installation. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment one is released.
HarborGuard Coverage
Detection of CVE-2026-54809 is available across every HarborGuard environment: the CVE is ingested from upstream advisory feeds (including Patchstack) within minutes of publication and matched against customer images, including custom-built WordPress images that bundle the GIFT4U plugin. Any image containing an affected version of the plugin (1.0.10 or earlier) is flagged automatically in the pipeline scan.
AvailableHarborGuard scores this CVE at 9.3 CRITICAL (CVSS v3.1) and weights it against each customer environment's compliance policy to determine priority and routing. Triage findings are delivered to the appropriate team inbox within each customer organization based on their configured notification and escalation rules.
AvailableBecause no upstream fix version exists for CVE-2026-54809, HarborGuard re-checks the advisory each ingest cycle and will make a patched-image rebuild available automatically the moment VillaTheme publishes a corrected release. For customers with auto-remediation enabled, the rebuild, regression-test run, and PR against affected workloads will be triggered without manual intervention once a fix version is confirmed.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The plugin is exposed over the network; an attacker must be able to send HTTP requests to the WordPress installation to reach the vulnerable code path.
- AuthenticationNot required
No account or credentials of any kind are needed; the vulnerable endpoint is accessible to anonymous requests.
- Victim interactionNot required
The attack is entirely server-side; no user action such as clicking a link or visiting a page is needed to trigger the injection.
- Attack complexityDetail
Exploitation is reliable and condition-free; no race conditions, memory-layout knowledge, or special environmental state is required beyond network access.
Blast Radius
- Reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
- Blind injection timing or boolean techniques allow an attacker to enumerate the full database schema and extract records incrementally without triggering obvious errors.
- Availability of the WordPress installation can be partially degraded through resource-intensive injected queries, consistent with the CVSS A:L (Low) impact rating.
- The scope is changed (S:C), meaning impact can extend beyond the plugin itself to other data stored in the same database instance, such as WooCommerce order records or other co-hosted plugin tables.
How HarborGuard Handles This
Available on HarborGuard: scanning for CVE-2026-54809 is active across all connected environments, and any image bundling GIFT4U 1.0.10 or earlier will appear in the vulnerability report immediately. Because no upstream patch exists at this time, HarborGuard monitors the Patchstack advisory and VillaTheme release channel each ingest cycle and will trigger a patched-image rebuild the moment a fix version is published. For customers with auto-remediation enabled, that rebuild is followed by an automated regression-test run and a PR opened against affected workloads. While waiting for an upstream fix, compensating controls worth considering include: placing a web application firewall rule in front of the affected WordPress installation to block SQLi-pattern requests, applying network policy to restrict database egress from the WordPress container to known-good sources only, and disabling the GIFT4U plugin if gift-card functionality is non-essential for the environment.
- VillaTheme / GIFT4U≤ 1.0.10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L