UDesign Core WordPress plugin: SQL injection by authenticated Subscriber users

Summary

UDesign Core, a WordPress plugin by AndonDesign, is affected up to and including version 4.15.0. An attacker with a Subscriber account, the lowest standard WordPress role, can inject SQL commands through the plugin. Successful exploitation can expose, modify or delete database content, including user accounts and private data. Patchstack rates the flaw as high priority, and no official fixed version was available at the time of the source review.

Affected

• UDesign Core WordPress plugin (package u-design-core), versions up to and including 4.15.0
• Start of the affected range: n/a (unknown)

Fixed in

• Unknown. No official patch available according to Patchstack.

Workaround

• Patchstack has issued a mitigation rule that blocks attacks until an official patch is available (only for Patchstack customers, according to the vendor page).
• Close open user registration or lower the default role so that new users cannot obtain Subscriber accounts.
• Remove unused Subscriber and other low-privilege accounts.
• Deactivate the plugin if its functions are not required.
• Restrict the database user to the minimum required privileges to limit the impact of SQL injection.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
• No public proof of concept found in the reviewed sources.
• Not listed as known exploited (KEV).
• Patchstack states the vulnerability is expected to become exploited and is used in mass-exploit campaigns for similar flaws.

Our recommendation

• Check all WordPress sites for u-design-core version 4.15.0 or earlier.
• Close open registration and review all Subscriber accounts now.
• Enable Patchstack or an equivalent WAF with virtual patching.
• Monitor the Patchstack entry and vendor channels for a fixed version, then update and verify the installed version.
• Keep WordPress core and other plugins up to date.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: WordPress UDesign Core Plugin <= 4.15.0 SQL Injection patchstack.com
• HOL Guard: CVE-2026-42416 UDesign Core SQL Injection hol.org
• Strix: CVE-2026-42416 www.strix.ai
• OffSeq Radar: CVE-2026-42416 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:23.