# CVE-2026-121769: WP w3all phpBB SQL injection

Source: https://junglewise.ai/threats/cve-2026-121769-improper-neutralization-of-special-elements-used-in-an-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-121769 · Severity: high · CVSS 8.5 · Published 2026-11-09

The WP w3all phpBB integration plugin for WordPress allows attackers to inject malicious SQL commands into database queries, potentially exposing or modifying sensitive information. An attacker with subscriber-level permissions or lower can exploit this vulnerability to read, modify, or delete database records including user accounts and private data.

Technologies: [Axew3.Com WP w3all phpBB](https://junglewise.ai/threats/technologies/wp-w3all-phpbb). Vendors: [Axew3.Com](https://junglewise.ai/threats/vendors/axew3-com).

## Quick answers

**Is CVE-2026-121769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121769 being exploited in the wild.

**How severe is CVE-2026-121769?** High severity, with a CVSS score of 8.5, published 9 November 2026.

**Which products and versions are affected?** Axew3.Com WP w3all phpBB through 3.1.9.

**Is there a fix for CVE-2026-121769?** Yes: fixed in 3.2.0. Until then: If unable to update immediately, restrict access to the plugin or disable it until patching is complete. Consider using a security plugin such as Patchstack to block exploitation attempts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121769 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121769?** Check whether you run Axew3.Com WP w3all phpBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.2.0

If unable to update immediately, restrict access to the plugin or disable it until patching is complete. Consider using a security plugin such as Patchstack to block exploitation attempts.

## Technical details

A SQL injection vulnerability exists in the WP w3all phpBB WordPress plugin (versions 3.1.9 and earlier) due to improper neutralization of special elements in SQL commands. The vulnerability requires subscriber privileges or above to exploit and allows direct database manipulation via crafted SQL input. This is patched in version 3.2.0.

## Affected products

- axew3.com WP w3all phpBB through 3.1.9

## Timeline

- 2026-11-07: disclosed
- 2026-11-09: advisory
- 2026-11-09: patched: Version 3.2.0 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-w3all-phpbb-integration/vulnerability/wordpress-wp-w3all-phpbb-plugin-3-1-9-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-w3all-phpbb-integration/vulnerability/wordpress-wp-w3all-phpbb-plugin-3-1-9-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [WP w3all phpBB cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-78293-wp-w3all-phpbb-cross-site-scripting-vulnerability)
- [WP w3all phpBB SQL injection in subscriber queries](https://junglewise.ai/threats/cve-2026-73998-wp-w3all-phpbb-sql-injection-in-subscriber-queries)