CVE-2026-54843: WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the MDTF WordPress plugin (versions 1.3.7 and below), developed by PluginUs.Net. The flaw is reachable over the network without any credentials, and no user interaction is required to trigger it. Successful exploitation gives an attacker read access to the underlying database and causes minor service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session token is needed; the vulnerable endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attacker can trigger the SQL injection directly without requiring any action from a logged-in user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, specific memory layout, or environmental dependency is required.

Blast Radius

• Reads arbitrary rows from the WordPress database, including user credentials (hashed passwords), email addresses, stored session tokens, and plugin configuration data.
• Because the scope is changed (S:C in the CVSS vector), data accessible to the database user beyond the WordPress schema may also be read if the DB account has broader grants.
• Causes limited availability impact; the database service may experience degraded performance or partial disruption under sustained injection queries.