Read the docs
TI-2026-75238 Aliases CVE-2026-94388GHSA-rpvq-cc9f-qxvg

SQL injection in WordPress Green Popups plugin

Priority MEDIUM 45CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The halfdata Green Popups plugin for WordPress, from n/a before 7.6.3, does not neutralize special elements in SQL commands (CWE-89), which allows blind SQL injection. An unauthenticated remote attacker can inject SQL commands and read sensitive data from the database, with high confidentiality impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed Green Popups (halfdata): 7.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
halfdataGreen Popupsbefore 7.6.37.6.3Patch availableCNA
  • Green Popups Vendorhalfdata Affected before 7.6.3 Fixed in 7.6.3 Patch available CNA

Remediation

Update the halfdata Green Popups plugin to version 7.6.3.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Green Popups (halfdata) Fixed in 7.6.3

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-94388
  2. 2026-10-16 Alias added: GHSA-rpvq-cc9f-qxvg

References

Other 1

  • TI-2022-26254 Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings CVSS 4.0MEDIUM 5.1
  • TI-2026-25064 WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-09812 Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences