Crowd Favorite DXP ToolKit: SQL injection in WordPress plugin
Summary
The WordPress plugin DXP ToolKit by Crowd Favorite contains an SQL injection vulnerability (CWE-89). According to the CVE data, an unauthenticated remote attacker can send crafted requests to reach the database. Successful exploitation can allow reading, modifying or deleting database content, including user accounts. Patchstack rates the issue as high priority with a CVSS 3.1 base score of 9.3.
Affected
- Crowd Favorite DXP ToolKit (WordPress plugin) up to and including 2.0.1
- Unknown whether versions between 2.0.1 and 2.0.2 exist.
Fixed in
- Version 2.0.2 or later (WordPress.org). The changelog for 2.0.2 lists a fix for SQL injection via the search parameter on the ruleset pagination endpoint. Linking this fix to CVE-2026-115607 is an inference from aggregator data.
Workaround
- No vendor workaround found.
- Deactivate the plugin until it is updated (suggestion, not from a source).
- Restrict access to the dxptoolkit/v1 REST routes at the web server or WAF (suggestion, not from a source).
Exploitation
- Not known to be exploited (OffSeq). Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public PoC found in our searches; a public PoC cannot be fully excluded.
Our recommendation
- Update DXP ToolKit to 2.0.2 or later on all WordPress sites as a priority.
- If an update is not possible immediately, deactivate the plugin or restrict access to its REST routes.
- Review server logs for unusual requests to the dxptoolkit REST routes.
- Check the Patchstack advisory and the NVD record once published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress DXP ToolKit plugin <= 2.0.1 SQL injection patchstack.com
- WordPress.org plugin changelog (en-gb), DXP ToolKit en-gb.wordpress.org
- WordPress.org plugin page, DXP ToolKit wordpress.org
- OffSeq Radar: CVE-2026-115607 radar.offseq.com
- OffSeq Radar: aggregated SQL injection entry (affected <2.0.2, fixed in 2.0.2) radar.offseq.com
- Strix: CVE-2026-115607 www.strix.ai
- VulDB entry 427982 vuldb.com
- CVE aggregator: CVE-2026-115607 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:32.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.