Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-09 | 1 | Disclosure1 |
| 2026-07-26 | 1 | Patch1 |
🚨 HIGH severity CVE-2016-20065 (CVSS 8.2): SQL injection in Product Catalog 8 1.2 WordPress plugin. Unauthenticated attackers can extract sensitive database data via admin-ajax[.]php. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/DCnqDxsNSb
Post summary
The tweet highlights a high-severity SQL injection in the Product Catalog 8.1.2 WordPress plugin and urges users to apply the patch immediately.
CVE-2016-20065 Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… https://www.cve.org/CVERecord?id=CVE-2016-20065
Post summary
The post announces that the WordPress Product Catalog 8 1.2 plugin contains an unauthenticated SQL injection flaw (CVE‑2016‑20065) enabling arbitrary SQL execution.