Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-2495 SQL Injection in WPNakama WordPress Plugin via Unauthenticated REST API Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2495
Post summary
A SQL injection vulnerability in the WPNakama WordPress plugin allows unauthenticated attackers to exploit the REST API endpoint, but no evidence of exploitation, PoC, or patch is provided.
🚨 HIGH severity SQL Injection in WPNakama plugin for WordPress exposes sensitive data via REST API. All versions up to 0.6.5 affected. Patch ASAP or mitigate! 🔒 https://radar.offseq.com/threat/cve-2026-2495-cwe-89-improper-neutralization-of-sp-08e20fbb #OffSeq #WordPress #SQLI... https://t.co/FnCYQ1PS4C
Post summary
The tweet announces a high‑severity SQL injection in the WPNakama plugin and urges users to patch or mitigate the vulnerability.
CVE-2026-2495 The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of th… https://www.cve.org/CVERecord?id=CVE-2026-2495
Post summary
CVE-2026-2495 exposes a SQL injection flaw in the WPNakama WordPress plugin through the 'order' parameter; no PoC, exploit, or patch details are given, nor is there evidence of active exploitation.