# CVE-2026-108179: PluginUs.Net WOLF SQL injection in bulk-editor

Source: https://junglewise.ai/threats/cve-2026-108179-improper-neutralization-of-special-elements-used-in-an-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108179 · Severity: high · CVSS 7.6 · Published 2026-10-13

WOLF is a WordPress plugin for bulk editing content. A SQL injection vulnerability in the bulk-editor component allows attackers with editor-level privileges to read, modify, or delete the entire database, including user accounts and sensitive data.

Vendors: [PluginUs.Net](https://junglewise.ai/threats/vendors/pluginus-net).

## Quick answers

**Is CVE-2026-108179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108179 being exploited in the wild.

**How severe is CVE-2026-108179?** High severity, with a CVSS score of 7.6, published 13 October 2026.

**Which products and versions are affected?** PluginUs.Net WOLF through 1.1.1.

**Is there a fix for CVE-2026-108179?** Yes: fixed in 1.1.2. Until then: Update to version 1.1.2 or later. If unable to update immediately, restrict editor-level access to trusted administrators only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108179 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108179?** Check whether you run PluginUs.Net WOLF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.2

Update to version 1.1.2 or later. If unable to update immediately, restrict editor-level access to trusted administrators only.

## Technical details

A blind SQL injection vulnerability exists in the WOLF WordPress plugin affecting versions through 1.1.1. The vulnerability requires editor-level privileges to exploit and allows attackers to execute arbitrary SQL commands against the database. The issue is patched in version 1.1.2.

## Affected products

- PluginUs.Net WOLF through 1.1.1

## Timeline

- 2026-09-27: disclosed: Reported to Patchstack
- 2026-10-13: advisory: Patchstack early warning and public disclosure

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/bulk-editor/vulnerability/wordpress-wolf-plugin-1-1-1-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/bulk-editor/vulnerability/wordpress-wolf-plugin-1-1-1-sql-injection-vulnerability?_s_id=cve)