CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cubewp1211 | CubeWP Framework | up to 1.1.30 | — | No fix listed | CNA |
- CubeWP Framework Vendorcubewp1211 Affected up to 1.1.30 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6453
- 2026-10-03 Alias added: GHSA-fg67-hgjg-74qh
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647620-e06a-49d5-8f9d-a59cb5a999b1?source=cve
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/functions/admin-functions.php#L2655
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L261
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L261
- https://plugins.trac.wordpress.org/browser/cubewp-framework/trunk/cube/modules/custom-fields/class-cubewp-relationships.php#L251
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/modules/custom-fields/class-cubewp-relationships.php#L251
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.29/cube/functions/admin-functions.php#L2655
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3627740%40cubewp-framework&new=3627740%40cubewp-framework
More cubewp1211 vulnerabilities
- TI-2026-11301 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVSS 3.1HIGH 7.5
- TI-2025-11123 CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure CVSS 3.1MEDIUM 5.3
- TI-2025-07886 CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode CVSS 3.1MEDIUM 6.4
- TI-2025-05862 Information disclosure in cubewp1211 CubeWP Framework CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-6453 · CVE Program
- CVE-2026-6453 · NVD
- FIRST EPSS
- GHSA-fg67-hgjg-74qh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences