CVE-2026-6453 Details
Description
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
A SQL injection vulnerability has been identified in the CubeWP Framework plugin for WordPress, affecting all versions up to and including 1.1.30. The issue arises from inadequate input sanitization in the 'cubewp_remove_relation()' AJAX function. Specifically, the vulnerability is caused by using 'wp_unslash()' on the 'relation_id' parameter, which removes the backslash escaping added by WordPress's 'wp_magic_quotes()' to all '$_POST' data. This effectively disables the only layer of protection against SQL injection. Although 'sanitize_text_field()' is applied afterward, it does not provide any SQL protection. As a result, authenticated attackers with subscriber-level access or higher can manipulate the SQL query by appending additional SQL commands, potentially leading to unauthorized data access or modification.
Users can update to CubeWP Framework version 1.1.31 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 1, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CubeWP Framework | <= 1.1.30 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |