CVE-2026-65546

Executive Summary

CVE-2026-65546 is an unauthenticated SQL injection vulnerability in the Qode Tours WordPress plugin, affecting all versions up to and including 3.1.3.1. The vulnerability allows a remote, unauthenticated attacker to inject arbitrary SQL queries into the plugin's database operations, potentially leading to full database disclosure, credential theft, and data integrity compromise. Given the CVSS score of 9.3 (Critical), the flaw presents a severe risk to any WordPress instance running the affected plugin, with a wide blast radius due to the plugin's popularity in the travel and tourism sector.

Technical Analysis

The Qode Tours plugin is a commercial WordPress extension designed for travel agencies and tour operators to create and manage tour listings, itineraries, and booking functionality. The vulnerability stems from insufficient sanitization and escaping of user-controlled input at the plugin's endpoint(s) before being concatenated into raw SQL queries.

Vulnerability Mechanism

The flaw resides in an unauthenticated endpoint that accepts HTTP request parameters (e.g., via $_GET or $_POST) and directly incorporates them into a SQL query—likely within an AJAX handler registered via wp_ajax_nopriv_ (which permits access to unauthenticated users) or a custom REST route that lacks permission callbacks. This is a classic first-order SQL injection where the attacker-supplied string becomes part of the SQL statement without parameterized queries, prepared statements, or adequate escape functions such as $wpdb->prepare().

Attack Surface

• Attack Vector: Network (HTTP/HTTPS)
• Authentication Required: None — the vulnerable path is accessible without logging in.
• Condition: The plugin must be active. The vulnerability is reachable regardless of whether the public-facing site uses caching, WAF, or CDN, provided those layers do not filter SQL metacharacters.
• Complexity: Low — no special conditions, user interaction, or prior knowledge of the database schema is required to trigger the injection (though schema enumeration improves payload efficacy).

Code-Level Explanation (Reconstruction)

Based on the vulnerability class and the plugin's functionality, the likely vulnerable pattern is:

// From a hypothetical qode-tours AJAX handler
add_action('wp_ajax_nopriv_qode_tours_get_tours', 'qode_tours_get_tours');

function qode_tours_get_tours() {
    global $wpdb;
    $destination = $_POST['destination']; // no sanitization
    $sql = "SELECT * FROM {$wpdb->prefix}tours WHERE destination = '$destination'";
    $results = $wpdb->get_results($sql);
    // ...
}

The attacker supplies destination with an SQL injection payload such as ' OR '1'='1, breaking out of the string context and executing arbitrary SQL. This constitutes a full pre-auth SQL injection into the WordPress database.

Exploitation Scenarios

Attack Chain Step-by-Step

Phase 1: Reconnaissance and Target Identification

1. The attacker identifies WordPress sites using the Qode Tours plugin by:

   • Scanning for wp-content/plugins/qode-tours/ in page source or via directory brute-forcing.
   • Using Shodan dorks such as http.title:"Qode Tours" or http.component:"WordPress" combined with plugin fingerprinting.
   • Leveraging WordPress plugin enumeration tools (e.g., WPScan) to confirm the exact plugin version.

2. The attacker confirms version ≤ 3.1.3.1 by reading the plugin's readme.txt if accessible, or via responsive patterns in JavaScript/CSS file versions.

Phase 2: Trigger/Weaponization

3. The attacker crafts an HTTP request to the unauthenticated vulnerable endpoint. This is typically a POST or GET request to an AJAX action such as:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=qode_tours_get_tours&destination=1' UNION SELECT user_login,user_pass,1,1,1,1 FROM wp_users--
   

4. The payload ' UNION SELECT is designed to:

   • Terminate the original SQL string injection point.
   • Inject a UNION clause to merge attacker-controlled results with the plugin's expected output.
   • Extract user_login and user_pass hashes from the wp_users table.
   • Use -- to comment out any trailing SQL syntax.

Phase 3: Payload Execution and Response Exfiltration

5. The query executes, and the server returns the results within the plugin's normal response structure. The attacker parses the HTTP response body to extract WordPress administrator username and password hashes.
6. To bypass output limitations (e.g., only a few columns displayed), the attacker iteratively runs UNION SELECT payloads with different column counts until the output aligns with displayed fields.

Phase 4: Post-Exploitation

7. The attacker cracks the harvested password hashes offline (using GPU-accelerated John the Ripper or Hashcat) to obtain a valid admin password, especially for weak 8-character or shorter passwords.
8. With admin access, the attacker:
   • Uploads a PHP webshell via the WordPress theme/plugin editor.
   • Establishes persistent backdoor access.
   • Exfiltrates the entire database (customer PII, booking records, payment metadata, user emails).
   • Defaces the site or installs crypto-mining malware.
   • Uses the compromised host as a pivot point for deeper network intrusion.

Impact Notes

• The CVSS Scope: Changed (S:C) indicates the compromise extends beyond the plugin—the entire database and underlying host can be taken over.
• Availability Impact: Low (A:L) reflects that availability is not the main goal; rather, confidentiality and integrity are the primary targets.

Impact Assessment

Business Impact: For a travel agency or tour operator, a successful exploitation results in:

• Confidentiality Breach (High): Full dump of customer PII (names, emails, phone numbers, passport details, payment records), administrator credentials, and site configuration—all exposed to attackers. This triggers severe GDPR/CCPA breach notification obligations and reputational damage.
• Integrity Compromise (High): Attackers can modify tour listings, prices, booking records, and inject malicious content/code into the site, undermining trust and potentially leading to financial fraud against customers.
• Availability Impact (Low): While the primary exploit targets data theft, an attacker could intentionally corrupt databases or drop tables if so inclined, causing downtime.

Affected Systems: Any WordPress installation with Qode Tours version 3.1.3.1 or earlier. Given the commercial nature, the install base is likely concentrated among travel businesses, boutique tour providers, and hospitality websites.

Blast Radius: The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates that a single unauthenticated request can compromise the entire application's data layer. There is no network segmentation boundary, and the plugin typically runs with privileges tied to the WordPress database user (often the full MySQL user for the site).

CVSS Subscore Notes: Confidentiality Impact High (C:H) and Integrity Impact High are implicit in the score (though only C:H and A:L are in the vector, the UNION/stacked-query capability enables full data modification). The critical 9.3 score underscores immediate remediation priority.

Detection Guidance

Sigma Rule

title: Qode Tours Unauthenticated SQL Injection Attempt
id: 6a1b3c4d-8e9f-4a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects SQL injection attempts against Qode Tours plugin endpoints (admin-ajax.php or REST API) with SQL keywords in unauthenticated HTTP requests.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65546
author: Valters IT Security
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Access logs of the web server hosting WordPress.'
detection:
    selection:
        cs-method: GET|POST
        cs-uri-query|contains:
            - 'admin-ajax.php'
            - 'wp-ajax'
        cs-uri-query|contains:
            - 'UNION SELECT'
            - ' UNION ALL SELECT'
            - 'sleep('
            - 'BENCHMARK('
            - 'information_schema.tables'
            - "' OR '1'='1"
            - '-- -'
    condition: selection
fields:
    - src_ip
    - cs-host
    - cs-uri-query
    - c-ip
falsepositives:
    - Legitimate SQL-like terms in plugin UI filters (unlikely but possible)
level: high
tags:
    - attack.t1190
    - cve.2026.65546
    - cwe.89

YARA Rule

rule Qode_Tours_SQL_Injection_Payloads {
    meta:
        author = "Valters IT Security"
        date = "2026-01-15"
        description = "Detects SQL injection payload strings common to CVE-2026-65546 exploitation attempts in web request bodies or access log URI components."
        reference = "CVE-2026-65546"
        severity = "high"
    strings:
        $s1 = "UNION SELECT" ascii nocase
        $s2 = "UNION ALL SELECT" ascii nocase
        $s3 = "information_schema.tables" ascii nocase
        $s4 = "wp_users" ascii nocase
        $s5 = "concat(" ascii nocase
        $s6 = "updatexml(" ascii nocase
        $s7 = "' OR '1'='1" ascii
        $s8 = "admin-ajax.php" ascii nocase
        $s9 = "qode_tours" ascii nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7) and
        any of ($s8, $s9)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-65546 - Qode Tours Unauthenticated SQL Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action="; http_uri; content:"qode_tours"; http_uri; pcre:"/(UNION\s+(ALL\s+)?SELECT|information_schema|UPDATE|INSERT|DELETE|SLEEP|BENCHMARK|concat|0x)/i"; sid:2026655461; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-65546, cwe CWE-89; classtype:web-application-attack; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65546;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and wildcard(http.request.uri, "*/admin-ajax.php*")]
  [http where string(http.request.body.text) like~ ".*qode_tours.*" and
    (string(http.request.body.text) like~ ".*UNION.*SELECT.*"
     or string(http.request.body.text) like~ ".*information_schema.*"
     or string(http.request.body.text) like~ ".*' OR '1'='1.*"
     or string(http.request.body.text) like~ ".*sleep\\(.*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin-ajax.php%") 
| rex field=_raw "action=(?<wp_action>\w+)"
| where match(wp_action, "qode_tours") 
| search (uri_query="*UNION*SELECT*" OR uri_query="*information_schema*" OR uri_query="*' OR '1'='1*" OR uri_query="*sleep(*" OR uri_query="*BENCHMARK(*" OR body="*UNION*SELECT*" OR body="*information_schema*")
| table _time src_ip uri uri_query body
| stats count by src_ip uri uri_query

Wazuh OSSEC Rule

<group name="web_application_attacks,">
  <rule id="198546" level="10">
    <decoded_as>web-access</decoded_as>
    <description>Qode Tours SQL Injection Attempt Detected (CVE-2026-65546)</description>
    <match>admin-ajax.php</match>
    <regex>action=qode_tours</regex>
    <regex>(UNION|information_schema|' OR '1'='1|sleep\(|BENCHMARK\(|concat\(|0x)</regex>
    <group>attack.t1190,cwe.89,cve.2026</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. As of this writing, no vendor patch, advisory, or release note has been published for CVE-2026-65546 by Qode or any upstream source. The plugin remains vulnerable in all versions ≤ 3.1.3.1.

Immediate Mitigations (Defense-in-Depth):

1. Deactivate the plugin on production and staging environments until a patch is available. If the plugin is not essential to recurring business logic, delete it entirely.
2. Block unauthenticated access to the plugin's AJAX handlers via web server rules:
   • Nginx: Deny direct access to /wp-admin/admin-ajax.php unless the request includes a valid nonce (however, nonces are not validated on vulnerable endpoints—this is a temporary stopgap).
   • Use a Web Application Firewall (WAF) rule to block POST requests to admin-ajax.php containing both action=qode_tours and SQL keywords via regex.
3. Harden database privileges: Ensure the WordPress MySQL user is NOT running with FILE, PROCESS, SUPER, or GRANT privileges. Restrict the user to only SELECT, INSERT, UPDATE, DELETE on the WordPress database to limit the impact of an injection.
4. Employ a database activity monitor to alert on queries containing UNION, SLEEP, or referencing information_schema.

Patch/Upgrade Steps:

• Monitor the Qode plugin's official changelog (qodeinteractive.com) and the WordPress plugin directory. Once a patched version (e.g., 3.1.4 or beyond) is released, update immediately.
• Verify the integrity of the update by checking the plugin's SHA-256 checksum or downloading from the official vendor only.
• After patching, conduct a full vulnerability scan (WPScan, Burp Suite) to confirm the injection vector is remediated.

Long-Term Hardening:

• Subscribe to vendor security mailing lists and the WordPress security advisories feed (Patchstack, WPScan).
• Establish a routine weekly scan of all installed plugins for known CVEs.
• Implement principle-of-least-privilege for all database users and segregate the WordPress DB user from other application data.
• Enable security logging at the web server and database level, and integrate with a SIEM for automated alerting.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65546
2. WPScan Advisory (pending vendor disclosure): https://wpscan.com/ (search "Qode Tours" after the next plugin index update)
3. Qode Interactive Official Site / Changelog: https://qodeinteractive.com/ (monitor for Qode Tours version updates)
4. CWE-89 SQL Injection Reference: https://cwe.mitre.org/data/definitions/89.html
5. MITRE ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns: No in-the-wild exploit activity or threat actor campaigns have been publicly documented for CVE-2026-65546 as of this report. The lack of a known exploit does not reduce severity—since the vector is trivially discoverable and the plugin's AJAX handlers are detectable via simple fingerprinting, exploitation is highly likely once public PoC surfaces. Proactive monitoring and mitigation are strongly advised.