Qode Tours WordPress plugin: SQL injection by authenticated subscribers
Summary
The Qode Tours WordPress plugin up to version 3.1.3.2 contains an SQL injection flaw (CWE-89). An attacker with a subscriber account can inject SQL queries and may read, modify or delete database content, including user accounts and private data. No vendor patch is confirmed in the available sources, and no exploitation in the wild is known.
Affected
- Qode Tours WordPress plugin, versions 3.1.3.2 and earlier
- The plugin is shipped with the Bridge theme; distribution outside the bundle is unknown.
Fixed in
- Unknown. The fixed version is not confirmed; the vendor changelog lists 3.1.3.3 and 3.1.3.4, but it does not state that these fix this CVE.
Workaround
- No vendor-issued workaround known.
- Disable or restrict open user self-registration.
- Remove unused subscriber or customer accounts and enforce strong passwords with 2FA.
- Place a web application firewall in front of the site and ask the vendor for a rule for this flaw.
Exploitation
- Exploited in the wild: no evidence found. CISA ADP lists exploitation as none and automatable as no.
- Public proof of concept: unknown (none found).
- EPSS score reported as 0.00332 (may change).
- Related CVE-2026-65546 (unauthenticated, CVSS 9.3) affects the same plugin and is expected to be exploited.
Our recommendation
- Check whether the plugin is installed and whether open subscriber registration is enabled.
- Ask Qode or Patchstack for the fixed version and update to the latest vendor release as soon as it is confirmed.
- Patch CVE-2026-65546 together with this CVE as one maintenance task.
- Restrict account creation and review existing accounts.
- Monitor logs for unusual database errors or requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-42712 patchstack.com
- OpenCVE CVE-2026-42712 app.opencve.io
- Vulners RAPID7 CVE-2026-42712 (EPSS) vulners.com
- Bridge theme changelog (Qode) bridge.qodeinteractive.com
- Patchstack advisory CVE-2026-65546 (related) patchstack.com
- Themesinfo Qode Tours plugin listing themesinfo.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:58.
Original description (NVD)
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.