CVE-2026-56034: WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the Library Management System WordPress plugin at version 3.5.7 and earlier. The vulnerability is reachable over the network and requires no login or user interaction, meaning any remote attacker can send a crafted request directly to an affected WordPress site. Successful exploitation lets an attacker read sensitive data from the underlying database and cause limited service disruption. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin's vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection point is reachable by any anonymous HTTP request.

• Victim interactionNot required

  The attacker acts entirely on their own without needing any action from a logged-in user or site administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, special memory layout, or environmental prerequisite stands between the attacker and a successful injection.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials, password hashes, API keys, and any personal data held in plugin tables.
• With full database read access and a scope-changed impact rating, data from other logical tenants or site installations sharing the same database server may also be exposed.
• The attacker can trigger limited availability disruption, such as causing slow or failed page loads, by sending resource-intensive SQL payloads.