CVE Intelligence
Analysis AI-assisted

CVE-2026-56062: Quotes llama Unauthenticated SQL Injection

An unauthenticated SQL Injection flaw (CWE-89) affects Quotes llama versions up to and including 3.1.5. The CNA Patchstack rated it critical with a CVSS 3.1 base score of 9.3. The record shows no CISA KEV listing and no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an unauthenticated SQL Injection in the Quotes llama plugin, affecting versions up to and including 3.1.5. The assigned weakness is CWE-89 (SQL Injection). The Patchstack reference is hosted in its WordPress plugin database, which suggests the product is a WordPress plugin.

Impact

  • Confidentiality: rated High in the CVSS vector.
  • Integrity: rated None in the CVSS vector.
  • Availability: rated Low in the CVSS vector.
  • Scope: rated Changed in the CVSS vector.

SQL injection flaws can allow unauthorized reading or modification of database content. The specific data that could be exposed is not described in the record.

Affected products and versions

The record states that Quotes llama versions up to and including 3.1.5 are affected. The structured affected and fixes lists in the record are empty, so vendor-side version identifiers and any fixed release are not confirmed.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.004 with a percentile of 0.324.

Remediation and mitigation

  • Identify every site running Quotes llama and confirm the installed version.
  • Check the Patchstack page and vendor channels for a fixed release, since the record provides none.
  • If no fix is available, consider deactivating or removing the plugin until a supported update is confirmed.
  • As interim measures, limit public exposure of affected sites and consider web application firewall protections against SQL injection patterns.
  • Apply least-privilege permissions to database accounts used by the site.

Detection guidance

  • Review web server and application logs for unusual requests to the plugin, especially those with unexpected parameter values.
  • Watch for database error messages returned to clients and for unexpected database query activity.
  • Monitor for unexplained changes to data managed by the plugin.

Limitations of the available information

The record has no title, no structured affected or fixed version lists, and no vendor statement. Its source status is Deferred. The CVSS score comes from the CNA audit@patchstack.com, and the record shows no other scoring provider. The EPSS date is later than the publication date.

Frequently asked questions

Is this vulnerability being exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version available?

The record does not list a fixed version. Check the Patchstack page and the vendor channels for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.