CVE-2026-96330: tagDiv Opt-In Builder WordPress Plugin up to 1.7.6 - SQL Injection

Overview

The record describes a SQL Injection weakness (CWE-89) in the tagDiv Opt-In Builder plugin for WordPress, associated with the td-subscription component. The description states that the flaw allows blind SQL injection and that the affected range runs through version 1.7.6.

Impact

Patchstack reports a CVSS 3.1 base score of 9.3. The vector in the record indicates a network-reachable attack with low complexity, no privileges required, no user interaction, a changed scope, high confidentiality impact, no integrity impact and low availability impact. Taken together, a successful exploit could expose database content to an attacker without a login, which is an inference from the vector rather than a statement from the source.

Affected products and versions

• Product listed: tagDiv tagDiv Opt-In Builder (td-subscription component).
• Range listed: up to and including 1.7.6, shown in the record as 'from n/a through 1.7.6'.
• The record does not list any fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability in the record is 0.00229 with a percentile of 0.12718 (dated 2026-10-13), and the SSVC exploitation field is 'none' while automatable is 'yes'. These values indicate a low modeled likelihood of exploitation at the time of the record, but they are not a guarantee.

Remediation and mitigation

• Check the Patchstack entry and the vendor channels for an updated release. Do not assume a fix exists because none is listed.
• If you run a version up to 1.7.6 and no fix is confirmed, consider deactivating the plugin or restricting access to the affected functionality until guidance is available.
• Limit the database account used by WordPress to the privileges it truly needs.
• Use web application firewall rules as a temporary compensating control, while recognising they are not a substitute for patching.
• If compromise is suspected, review data integrity and rotate credentials stored in the database.

Detection guidance

• Review web server and application logs for unusual request volume or repeated requests to subscription-related endpoints.
• Look for database errors or abnormal response timing from the web application, which can accompany blind injection attempts.
• Monitor database logs for queries originating from the web application account that do not match normal plugin behaviour.

Limitations of the available information

• No fixed version, vendor advisory or patch identifier is present in the record.
• The specific vulnerable parameter or endpoint is not identified in the record.
• The record gives a 'from n/a' lower bound, so the earliest affected version is unknown.
• The record is marked with source status 'Deferred' and was published on 2026-10-09; later updates may exist outside the sources consulted.
• Exploitation prevalence beyond the EPSS and SSVC values in the record is unknown.

Frequently asked questions

What is CVE-2026-96330?

It is a blind SQL Injection weakness (CWE-89) in the tagDiv Opt-In Builder WordPress plugin, affecting versions through 1.7.6 according to the record.

Is there a fixed version?

The record does not list any fixed version. Check the Patchstack entry and vendor channels for updates before assuming a fix is available.

Is this CVE being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.