CVE-2026-19944

Executive Summary

CVE-2026-19944 is a second-order SQL injection vulnerability in the WP Crowdfunding plugin for WordPress, affecting all versions up to and including 2.2.1. The flaw exists in the handling of the 'wpneo_reward' post meta parameter, where insufficient escaping and lack of query preparation allow authenticated attackers with Shop Manager-level access or above to inject malicious SQL payloads. The injection is staged through the WooCommerce REST API products endpoint, and the malicious query executes whenever a public visitor views a page rendering the campaign rewards sidebar, potentially exposing sensitive database contents including user credentials, session tokens, and other protected data.

The vulnerability carries a CVSS score of 4.9 (Medium severity) with a high confidentiality impact, no integrity impact, and no availability impact. The attack requires a compromised Shop Manager account or equivalent privileges but can be executed over the network without user interaction. As of this report, no patch has been released, no public proof-of-concept exists, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating it has not yet been confirmed as actively exploited in the wild.

Technical Analysis

The vulnerability is classified as CWE-89 (SQL Injection) and stems from improper neutralization of special elements used in SQL commands. The root cause lies in two distinct weaknesses in how the WP Crowdfunding plugin processes reward-related data:

1. Insufficient Escaping: The plugin fails to apply proper escaping to the user-supplied wpneo_reward parameter. Without adequate escaping, special SQL characters such as single quotes ('), double quotes ("), backslashes (\), and comment markers (-- or /*) pass through unmodified into the SQL query context.

2. Lack of Prepared Statements: The existing SQL query does not utilize parameterized queries or prepared statements. Instead, user-supplied values are concatenated directly into the SQL syntax string, allowing an attacker to break out of the intended data context and append arbitrary SQL commands.

The vulnerability is uniquely characterized as a second-order injection. Unlike classic first-order SQL injection where the payload is executed immediately upon submission, this attack follows a two-phase lifecycle:

Phase 1 — Injection (Staging): An authenticated attacker with Shop Manager-level privileges (or higher, such as Administrator) uploads a malicious payload through the WooCommerce REST API endpoint POST/PUT /wp-json/wc/v3/products/{id}. The wpneo_reward post meta field stores the malicious content in the WordPress database. Because the stored value is not sanitized or validated at the point of entry, the payload persists within the database records.

Phase 2 — Execution (Triggering): When a public visitor views a product or campaign page that renders the rewards sidebar component, the plugin retrieves the stored wpneo_reward post meta value and incorporates it into a SQL query without proper escaping or preparation. At this point, the stored malicious content is interpreted as SQL code, and the injected query executes against the underlying MySQL/MariaDB database.

The attack surface includes any publicly accessible WordPress site running the WP Crowdfunding plugin at version 2.2.1 or earlier. The plugin integrates with WooCommerce, meaning the attack vector leverages an existing third-party API endpoint that may be considered a trusted communication channel. The conditional requirement is that the target site must have both the WP Crowdfunding plugin and WooCommerce installed and configured with the REST API enabled.

Technical details on the specific SQL query structure, database table names, and column formats are not disclosed in public descriptions of this vulnerability. Insufficient technical detail is available publicly to establish the exact queries involved. The vulnerability description confirms only that the query processes the wpneo_reward post meta field and is accessible through the product REST endpoint.

Exploitation Scenarios

The exploitation of CVE-2026-19944 requires a coordinated attack chain that spans authenticated access, REST API interaction, and public-facing content delivery. The following attack chain is inferred from the vulnerability class and public description:

Step 1 — Reconnaissance and Target Identification

An attacker begins by identifying WordPress sites running vulnerable versions of WP Crowdfunding. This can be accomplished through search engine queries for specific plugin footprints, WordPress enumeration tools (e.g., WPScan), or by scanning for the plugin's directory path and assets. Once a target is identified, the attacker determines whether the site utilizes WooCommerce and whether the REST API is accessible (typically at /wp-json/).

The attacker then needs to obtain valid credentials for an account with Shop Manager-level access or higher. Common acquisition methods include:

• Credential stuffing attacks against WordPress login portals.
• Password spraying using previously leaked credentials.
• Phishing campaigns targeting site administrators.
• Privilege escalation from lower-privilege accounts within the WordPress ecosystem.

Step 2 — Initial Compromise and Authentication

The attacker authenticates against the WordPress site, establishing a valid session with Shop Manager permissions. WordPress role hierarchy places Shop Manager above Customer and Subscriber but below Administrator. This role has sufficient WooCommerce privileges to manage products and update product metadata through legitimate functionality.

The attacker identifies a product ID to target — either an existing product or a new one created with malicious intent. Tools such as curl, Postman, or custom scripts can be used to interact with the REST API.

Step 3 — Payload Injection via REST API

The attacker crafts a malicious HTTP request to the WooCommerce REST API products endpoint:

POST /wp-json/wc/v3/products/{product_id}

The request body contains a JSON or form-encoded update that includes the wpneo_reward post meta field. The payload is structured as a SQL injection string, for example:

' UNION SELECT user_login, user_pass, user_email FROM wp_users -- 

No public proof-of-concept is currently available; this payload representation is illustrative of the vulnerability class and not a confirmed working exploit. The malicious value is accepted by the REST endpoint without sanitization, and the WordPress update_post_meta() function stores the value verbatim in the wp_postmeta table.

Step 4 — Trigger and SQL Execution

Following successful payload storage, the attacker (or any visitor) navigates to a public-facing page that includes the campaign rewards sidebar component. The WP Crowdfunding plugin's template rendering process queries the wpneo_reward post meta for display purposes. During this query construction, the stored malicious payload is concatenated without escaping, producing a syntactically modified SQL statement.

The resulting query executes at the database layer with the WordPress database user's privileges. Each public page view triggers a fresh execution of the injected query. Attackers can chain multiple queries through stacked queries or UNION-based injection to extract data in a structured manner, though the exact technique depends on the database driver configuration.

Step 5 — Post-Exploitation Data Extraction

Successful exploitation grants the attacker read access to the WordPress database. Potential targets for extraction include:

• wp_users table containing usernames, password hashes, and email addresses.
• wp_usermeta table containing session tokens and user capabilities.
• WooCommerce order tables containing customer details and payment information.
• Post and option tables containing site configuration and sensitive business data.

The attacker exfiltrates this data through the public page responses, encoding results within the HTTP response body. Since the extracted data is rendered in the HTML page, it may be accessible through standard HTTP client tools.

Important caveat: The NVD description confirms no PoC exists publicly, and no Nuclei templates or exploit code are available. The exploitation scenario above represents a threat-informed reconstruction based on the vulnerability description and known second-order SQL injection patterns. Actual exploitation mechanics may differ based on implementation details not publicly documented.

Impact Assessment

Business Impact: The vulnerability presents a medium-severity risk (CVSS 4.9) with potential for significant confidentiality compromise. The high confidentiality impact subscore (C:H) indicates that an attacker can exfiltrate sensitive information from the database, underminining the security of both the platform and its users. WordPress databases commonly store hashed passwords, user email addresses, session authentication tokens, and, in WooCommerce deployments, customer information.

Affected Systems: All WordPress installations running WP Crowdfunding plugin version 2.2.1 or earlier are potentially vulnerable. The vulnerability affects only sites with WP Crowdfunding installed, and exploits require that WooCommerce also be present with REST API functionality enabled.

Blast Radius: The attack is limited to authenticated users with Shop Manager privileges or higher, representing a meaningful access control constraint. However, the impact extends far beyond the compromised account's data visibility. The database contains information from all users, customers, and administrative functions. Data exfiltration can compromise:

• Administrator credentials (enabling full site takeover).
• Customer personally identifiable information (PII) with privacy regulatory implications (GDPR, CCPA, etc.).
• Payment information stored within WooCommerce order records.
• Business operations data including revenue reporting and inventory information.

Privilege Context: The vulnerability requires high-level authenticated access (AV:N, PR:H). No user interaction is needed (UI:N). There is no integrity impact (I:N) — meaning an attacker cannot modify or delete data through this vulnerability alone, and no availability impact (A:N). This scope limitation reduces the likelihood of ransomware or site-takeover attacks but leaves the site exposed to severe data breaches.

Exploitation Environment: Since the attack requires Shop Manager access, it effectively represents a privilege escalation scenario from a moderately-trusted account to full database read access. In multi-tenant WordPress deployments or sites with multiple contributors, compromise of any Shop Manager account creates immediate database exposure risks.

Detection Guidance

The following detection content provides organizations with initial capability to identify exploitation attempts for CVE-2026-19944. These rules target the observable indicators described in the vulnerability details.

Sigma Rule

title: SQL Injection Attempt via wpneo_reward Post Meta
id: 8f4b2c9e-1d3a-4e7f-9b2d-6a5c8e1f3d9b
status: experimental
description: Detects attempts to exploit CVE-2026-19944 SQL injection in WP Crowdfunding plugin through product REST API updates
date: 2026/01/15
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    definition: WordPress access logs with REST API POST/PUT requests
detection:
    selection_endpoint:
        cs-method: POST
        cs-uri-stem|contains: /wp-json/wc/v3/products
    selection_payload:
        cs-uri-query|contains:
            - "wpneo_reward"
    condition: selection_endpoint and selection_payload
falsepositives:
    - Legitimate product updates from Shop Managers where description includes English words containing quotes
level: medium

YARA Rule

rule CVE_2026_19944_WP_Crowdfunding_SQLi
{
    meta:
        author = "ValterSIT Threat Intel"
        date = "2026-01-15"
        description = "Detect SQL injection attempts targeting WP Crowdfunding wpneo_reward field"
        reference = "CVE-2026-19944"
        score = 60

    strings:
        $wpfc_path = "wp-content/plugins/wp-crowdfunding" ascii wide nocase
        $rest_endpoint = "/wp-json/wc/v3/products" ascii wide nocase
        $meta_field1 = "wpneo_reward" ascii wide nocase
        $meta_field2 = "wpneo_reward=" ascii wide nocase

        $sqli_union = "UNION SELECT" ascii wide nocase
        $sqli_union_all = "UNION ALL SELECT" ascii wide nocase
        $sqli_sleep = "SLEEP(" ascii wide nocase
        $sqli_benchmark = "BENCHMARK(" ascii wide nocase
        $sqli_concat = "CONCAT(" ascii wide nocase
        $sqli_hex = "0x" ascii wide nocase
        $sqli_comment = "--" ascii wide nocase
        $sqli_comment_c = "/*" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        (($wpfc_path or $rest_endpoint) and
         ($meta_field1 or $meta_field2) and
         (2 of ($sqli_*)))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-19944 - WP Crowdfunding SQL Injection via wpneo_reward";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"/wp-json/wc/v3/products";
    content:"wpneo_reward";
    http.client_body;
    pcre:"/(\'|\"|--|#|\/\*).*( UNION SELECT| UNION ALL SELECT|SLEEP\(|BENCHMARK\(|CONCAT\(|0x[0-9a-fA-F]{4,}|INFORMATION_SCHEMA|DATABASE\(|VERSION\()/i";
    classtype:attempted-user;
    sid:202619944;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-19944, severity medium;
)

Elastic Detection

POST /_eql/search?filter_path=hits.hits
{
  "query": """
    sequence by source.ip
      [ any where process.name == "httpd" and
          url.path LIKE "*wp-json/wc/v3/products*" and
          http.request.method == "POST"
      ]
      [ any where event.category == "web" and
          url.path LIKE "*wp-json/wc/v3/products*" and
          http.request.method == "POST" and
          (
            wildcard(url.query, "*wpneo_reward*") or
            wildcard(http.request.body.content, "*wpneo_reward*")
          ) and
          wildcard(http.request.body.content, "*UNION*SELECT*") or
          wildcard(http.request.body.content, "*SLEEP(*") or
          wildcard(http.request.body.content, "*BENCHMARK(*")
      ]
  """,
  "timestamp_field": "@timestamp",
  "size": 100
}

Splunk SPL Query

index=web earliest=-7d
| where match(method, "POST")
| where like(uri_path, "%/wp-json/wc/v3/products%")
| spath input=form_data
| search form_data{wpneo_reward}=*
| rex field=form_data "wpneo_reward=(?<payload>[^&]+)"
| where match(payload, "(?i)(UNION\\s*(ALL\\s*)?SELECT|SLEEP\\s*\\\\(|BENCHMARK\\s*\\\\(|CONCAT\\s*\\\\(|0x[0-9a-fA-F]{4,}|INFORMATION_SCHEMA|DATABASE\\s*\\\\(|VERSION\\s*\\\\(|\\\"|\\\\'|--|/\\*)")
| eval exploit_indicators = if(match(payload, "(?i)(UNION|SLEEP|BENCHMARK|INFORMATION_SCHEMA|CONCAT)"), "HIGH_CONFIDENCE", "SUSPICIOUS")
| eval cve_id = "CVE-2026-19944"
| table _time, src_ip, src_port, uri_path, method, payload, exploit_indicators, status, dest_ip
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,web,attack,">
  <rule id="2026199" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*\/wp-json\/wc\/v3\/products\/*</field>
    <field name="method">POST</field>
    <regex>wpneo_reward</regex>
    <regex on="body">(?i)(UNION\s+(ALL\s+)?SELECT|SLEEP\(|BENCHMARK\(|CONCAT\(|0x[0-9a-fA-F]{4,}|INFORMATION_SCHEMA|--|/\*|\')</regex>
    <description>Possible SQL injection attempt exploiting CVE-2026-19944 in WP Crowdfunding</description>
    <group>sql_injection,web_application_attack,</group>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No patch is currently available. As of the analysis date, no patch exists, no vendor fix has been announced, and no official workarounds have been documented. The vendor (Themeum) has not released a patched version of WP Crowdfunding, and there is no associated CVE advisory referencing a fix.

Immediate Mitigations (Implement Today):

1. Restrict access to WooCommerce Shop Manager roles. Review all user accounts with Shop Manager privileges and remove accounts that are no longer actively needed. Enforce a least-privilege access model within WordPress.
2. If the WP Crowdfunding plugin is not actively in use for live campaigns, temporarily deactivate and uninstall the plugin. This removes the vulnerability's attack surface entirely.
3. Review WooCommerce REST API access and restrict it where possible. Consider using a Web Application Firewall (WAF) rule or reverse-proxy to block or flag API requests containing suspicious SQL patterns in the wpneo_reward field.
4. Implement database-level security controls. Determine the database user permissions used by WordPress. If the credentials allow unrestricted access beyond the WordPress schema, restrict them.
5. Monitor for unusual SQL errors or slow queries that indicate SQL injection probing attempts.

Patch/Upgrade Steps:

As no patch is available at this writing, any upgrade will not currently address this vulnerability. However, the following actions are recommended:

1. Subscribe to or monitor the WordPress plugin changelog pages for WP Crowdfunding. If the vendor releases version 2.2.2 or later, apply this update promptly.
2. Monitor ProjectDiscovery, GitHub advisories, and WordPress security forums for disclosure of a fix or available workaround.
3. If the vendor does not respond to responsible disclosure quickly, evaluate whether an alternative crowdfunding plugin maintains better security hygiene.

Long-Term Hardening:

1. Ensure WordPress core, all plugins, and themes are up to date with known security patches.
2. Implement a comprehensive WordPress security baseline: restrict file permissions, enforce strong passwords and MFA for all administrative accounts.
3. Implement a host-based Web Application Firewall to detect and block SQL injection attempts at the application layer.
4. Implement database activity monitoring. Audit all SQL queries that access the wp_postmeta table containing the wpneo_reward content.
5. Perform a database sweep to identify any existing payloads already stored in wp_postmeta. Manually review entries where meta_key equals wpneo_reward for suspicious SQL syntax.
6. Monitor CISA KEV updates for CVE-2026-19944; if it is later added to that list, address the vulnerability with elevated priority.
7. Store web server logs using a SIEM system to review for malicious REST API activity.

Given the unpatched status and the requirement for elevated privileges, prioritize restricting Shop Manager accounts and monitoring for unusual activity from them.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19944 — National Vulnerability Database entry for this CVE containing the vulnerability description and CVSS vector.
2. WP Crowdfunding Plugin Page: https://wordpress.org/plugins/wp-crowdfunding/ — Official plugin page; monitor for future version releases.
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Verify that CVE-2026-19944 is not on the active exploitation list and monitor for future updates.
4. CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html — MITRE CWE description of the vulnerability class.
5. WordPress REST API WooCommerce documentation: https://woocommerce.com/document/woocommerce-rest-api/ — reference for the product endpoint used in the injection chain.

As of the publication date of this report, no known threat actor campaigns in the wild have been publicly attributed to exploiting this specific CVE. No exploit code has been publicly released, and no Nuclei templates exist for automated detection. The vulnerability is not listed on the CISA KEV catalog. Defense teams should still treat this as a realistic attack vector given the medium severity and the availability of a clear injection path.