Sirv WordPress plugin: SQL injection via shortcode data

Summary

The Sirv image optimization plugin for WordPress up to and including version 8.2.5 contains an SQL injection flaw in its shortcode handling. An attacker with at least Contributor rights can inject SQL through the shortcode data parameter, which can expose or modify database content, including user data. The CVSS score of 8.5 comes from the CNA data, while WPScan rates the issue 4.9 (medium).

Affected

• Sirv WordPress plugin (slug: sirv), all versions from n/a through 8.2.5

Fixed in

• Version 8.2.6 or later (wordpress.org changelog, 2026-10-01)

Workaround

• No vendor-published workaround.
• Until the update is applied, review and reduce accounts with Contributor role or higher and check for unknown accounts.

Exploitation

• No known exploitation in the wild found. The CISA KEV catalogue was not checked directly.
• No public proof of concept found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact partial.

Our recommendation

• Update the Sirv plugin to version 8.2.6 or later as soon as possible.
• Check whether the plugin is installed on your WordPress sites, including inactive installations.
• Review accounts with Contributor role or higher and remove unneeded or unknown accounts.
• Monitor logs for unusual shortcode or AJAX requests until the update is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for Sirv plugin <= 8.2.5 patchstack.com
• WPSec WPSEC-2026-0324 wpsec.com
• WPScan Sirv plugin wpscan.com
• Sirv plugin on WordPress.org wordpress.org
• Strix CVE-2026-104389 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:31.