{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39479", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:42:07.235Z", "datePublished": "2026-04-08T08:30:09.840Z", "dateUpdated": "2026-04-08T08:30:09.840Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "suretriggers", "product": "OttoKit", "vendor": "Brainstorm Force", "versions": [{"changes": [{"at": "1.1.21", "status": "unaffected"}], "lessThanOrEqual": "1.1.20", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "timomangcut | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:57.362Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.<p>This issue affects OttoKit: from n/a through <= 1.1.20.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20."}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "Blind SQL Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:09.840Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability?_s_id=cve"}], "title": "WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20."}], "id": "CVE-2026-39479", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:22.670", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1.20]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OttoKit", "source": "cna", "vendor": "Brainstorm Force"}, "product": "ottokit", "vendor": "brainstorm_force"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:18:35.850294+00:00", "value": {"mitigation_remediation": ["Upgrade OttoKit to any release newer than version 1.1.20.", "If upgrade is not immediately possible, remove or deactivate the OttoKit plugin.", "Restrict access to the plugin\u2019s administrative interfaces to trusted users only.", "Monitor WordPress database logs for anomalous queries that may indicate injection attempts.", "Follow general WordPress hardening practices, such as using the latest core version and limiting administrative privileges."], "summary": {"action": "Immediate Patch", "impact": "Blind SQL Injection exposing database data"}, "threat_synthesis": {"affected_systems": "The affected product is the Brainstorm Force OttoKit plugin for WordPress. Versions up to and including 1.1.20 are vulnerable as indicated by the CVE description. The plugin is typically installed in WordPress sites as a plugin.", "description_and_impact": "The vulnerability is an improper neutralization of special elements used in an SQL command. Attackers can perform blind SQL injection through the OttoKit plugin, enabling retrieval or modification of database contents. This flaw is classified as CWE-89.", "risk_and_exploitability": "No EPSS score is available and the issue is not listed in the CISA KEV catalog. However, SQL injection is a high\u2011risk vulnerability. The likely attack vector is inferred to be via web requests to the plugin\u2019s endpoints, which any user with access to the WordPress site could potentially use. Exploitation would allow the attacker to read or alter sensitive database information, compromising confidentiality and integrity of the WordPress installation."}}}}, "created": "2026-04-08T19:30:48.712265+00:00", "updated": "2026-04-08T19:43:17.523041+00:00", "vendors": ["brainstorm_force", "brainstorm_force$PRODUCT$ottokit", "wordpress", "wordpress$PRODUCT$wordpress"]}