# CVE-2026-39479: Brainstorm Force OttoKit blind SQL injection in suretriggers

Source: https://junglewise.ai/threats/cve-2026-39479-brainstorm-force-ottokit-blind-sql-injection-in-suretriggers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39479 · Severity: high · CVSS 7.6 · Published 2026-04-08

OttoKit (also known as suretriggers) is a WordPress plugin used for automation and connecting different web services. A security vulnerability in this plugin allows an attacker with administrative access to perform blind SQL injection. This could lead to the unauthorized extraction of sensitive information from the website's database, potentially compromising user data or site configuration.

Technologies: [Brainstorm Force OttoKit](https://junglewise.ai/threats/technologies/ottokit). Vendors: [Brainstorm Force](https://junglewise.ai/threats/vendors/brainstorm-force).

## Quick answers

**Is CVE-2026-39479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39479 being exploited in the wild.

**How severe is CVE-2026-39479?** High severity, with a CVSS score of 7.6, published 8 April 2026.

**Which products and versions are affected?** Brainstorm Force OttoKit <= 1.1.20.

**Is there a fix for CVE-2026-39479?** A patch was published on 2026-03-23: Fixed in version 1.1.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39479 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39479?** Check whether you run Brainstorm Force OttoKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A blind SQL injection vulnerability exists in the Brainstorm Force OttoKit (suretriggers) plugin for WordPress due to improper neutralization of special elements in SQL commands. The flaw allows an authenticated attacker with high privileges (Administrator) to execute arbitrary SQL queries against the backend database via a network request. While the attack requires administrative credentials, the 'Scope' change in the CVSS vector suggests the impact may extend beyond the plugin's immediate environment. Attackers can leverage this to extract sensitive data from the database. The issue is fixed in version 1.1.21.

## Affected products

- Brainstorm Force OttoKit (suretriggers) <= 1.1.20

## Timeline

- 2026-02-21: disclosed: Reported by timomangcut to Patchstack
- 2026-03-23: advisory: Patchstack published advisory
- 2026-04-08: advisory: CVE published to NVD
- 2026-03-23: patched: Fixed in version 1.1.21

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Brainstorm Force OttoKit privilege escalation](https://junglewise.ai/threats/cve-2026-110372-incorrect-privilege-assignment-vulnerability-in-brainstorm-force)
- [OttoKit server-side request forgery](https://junglewise.ai/threats/cve-2026-32553-ottokit-server-side-request-forgery)