Tcard WP: Unauthenticated SQL injection via group_id parameter
Summary
The Tcard WP WordPress plugin through version 1.8.0 does not sanitise and escape the group_id parameter before using it in an SQL statement in an unauthenticated AJAX action. Anyone who can reach the website can exploit this without logging in and may read sensitive database content, such as customer data and admin password hashes. The CVSS vector indicates high confidentiality impact with no integrity or availability impact. No fixed version is known and no confirmed exploitation has been reported.
Affected
- Tcard WP WordPress plugin, all versions through 1.8.0
- Vendor and default configuration: Unknown
Fixed in
Unknown. WPScan lists the status as "No known fix". No vendor advisory or update notice was found.
Workaround
- Deactivate and remove the plugin if it is not business-critical
- If it must stay, restrict or block public access to the affected AJAX endpoint
- Add WAF rules for SQL injection patterns on admin-ajax.php as a temporary measure only
- Ensure database accounts follow least privilege and backups are tested
Exploitation
- Not listed in CISA KEV
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- Public proof of concept: Unknown
- No reports of in-the-wild exploitation found; this does not prove absence
Our recommendation
- Inventory all WordPress sites for the tcard-wp plugin and its version
- On any affected public site, remove or deactivate the plugin or restrict the endpoint as an interim measure
- Check WordPress.org and the WPScan entry weekly for a fixed release
- Review logs for unusual admin-ajax.php requests
- Verify database accounts use least privilege and backups are current
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry CVE-2026-81420 wpscan.com
- OpenCVE record CVE-2026-81420 app.opencve.io
- Vulners NVD record CVE-2026-81420 vulners.com
- Vulners VulnRichment CVE-2026-81420 vulners.com
- VulDB CVE-2026-81420 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:02.
Original description (NVD)
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.