CoreCVE
Back

HIGH

Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters

Published May 20, 2026

Description

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published May 20, 2026
Updated May 20, 2026
Reserved May 19, 2026
Link CVE-2026-9010
CISA Vulnrichment
Updated May 20, 2026
NVD
Status Deferred
Modified Jul 23, 2026
Link CVE-2026-9010
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-9010