Easy Pricing Tables: SQL injection by authenticated Contributor users

Summary

The WordPress plugin Easy Pricing Tables by Fatcatapps up to and including version 4.1.2 contains an SQL injection vulnerability (CWE-89). An attacker with a low-privilege Contributor account can send crafted requests over the network without user interaction. According to the vendor-linked assessment, the attacker could read, modify or delete data in the WordPress database, including user accounts and private data.

Affected

• Easy Pricing Tables WordPress plugin up to and including 4.1.2
• CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L (score 8.5)

Fixed in

• Version 4.1.3 or later (WordPress.org changelog for 4.1.3 describes a fix for SQL injection by authenticated non-admin users)

Workaround

Unknown.

• No vendor-documented workaround is available.
• Until the update is applied: review and remove unused Contributor or higher accounts and restrict new registrations. This is general hardening, not a vendor-documented fix.

Exploitation

• No evidence of exploitation in the wild found in the sources reviewed. CISA KEV status was not verified directly.
• No public proof of concept found.
• CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• Patchstack rates the priority as low and states that exploitation is unlikely.

Our recommendation

• Identify all sites running Easy Pricing Tables and confirm the installed version.
• Update the plugin to version 4.1.3 or later. This also covers CVE-2026-111947 (unauthorised post clone and publish, fixed in 4.1.3).
• Review all Contributor and higher accounts and remove those that are not needed.
• Prioritise sites that grant Contributor accounts (blogs, agencies, multi-author sites); sites with closed registration carry lower risk.
• Monitor logs for unusual database errors or requests to the plugin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: SQL Injection in WordPress Easy Pricing Tables Plugin patchstack.com
• WordPress.org: Easy Pricing Tables plugin (changelog) wordpress.org
• Wordfence Threat Intelligence: Easy Pricing Tables www.wordfence.com
• Patchstack: Easy Pricing Tables vulnerabilities patchstack.com
• Strix: CVE-2026-94115 (secondary source) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:43.