CVE Intelligence
Analysis AI-assisted

CVE-2026-54843: MDTF Plugin Unauthenticated SQL Injection

CVE-2026-54843 describes an unauthenticated SQL injection flaw (CWE-89) in MDTF versions up to and including 1.3.7. The CNA assigned a critical CVSS v3.1 base score of 9.3 with a network, low-complexity, no-privileges, no-user-interaction vector. No fixed version and no confirmed exploitation in the wild appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54843 is a critical SQL injection vulnerability (CWE-89) reported in MDTF versions up to and including 1.3.7. The record was published on 2026-06-25 with the CNA audit@patchstack.com and carries a Deferred source status.

Impact

  • The CNA scored the issue 9.3 under CVSS v3.1, with vector components indicating high confidentiality impact, no integrity impact and low availability impact.
  • The description states the flaw is unauthenticated, which is consistent with the vector's no-privileges and no-user-interaction values.
  • The practical consequences depend on the database configuration and on what the affected code exposes, which the sources do not describe.

Affected products and versions

  • Product: MDTF. The reference URL points to a WordPress plugin database entry, which suggests the product is a WordPress plugin (inference).
  • Affected range: versions up to and including 1.3.7, as stated in the description.
  • The record contains no structured affected or fixed version data.

Exploitation status

The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted, and no EPSS data is available.

Remediation and mitigation

  • Inventory all MDTF installations and compare their versions with the range stated in the record.
  • Check the referenced vendor database entry for a corrected release and apply it as soon as one is confirmed.
  • If no fix is available, consider temporarily deactivating the component on internet-facing sites until official guidance is published. This is a general defensive measure, not a verified fix.
  • Apply least-privilege principles to database accounts used by the site and consider web application firewall protections as defense in depth.

Detection guidance

  • Review web server and application logs for unusual or malformed input directed at MDTF functionality.
  • Monitor database error messages and unexpected query activity originating from the web application.
  • Audit the database accounts used by the site and remove unnecessary privileges.

Limitations of the available information

The sources do not provide a fixed version, the vulnerable component or parameter, the full vendor advisory text, or EPSS and SSVC data. Whether a particular deployment is affected cannot be determined from the record alone.

Frequently asked questions

Which MDTF versions are described as affected by CVE-2026-54843?

The description states the issue affects MDTF versions up to and including 1.3.7. The record does not provide structured affected version data.

Is there a confirmed fix or known active exploitation?

The record contains no fixed version, and the CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.