CVE-2026-84047 PUBLISHED

Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action

Assigner: WPScan
Reserved: 01.09.2026 Published: 12.09.2026 Updated: 12.09.2026

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Album Cover Finder
Versions Default: unknown
  • affected from 0 to 0.7.0 (incl.)

Credits

  • João Ramos Maciel finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE