Junglewise Threat Intelligence

CVE-2026-5028: Eight Day Week Print Workflow SQL injection in pp-get-articles

CVE-2026-5028 · Severity: medium · CVSS 6.5 · Published 2026-05-12

Executive brief

The Eight Day Week Print Workflow plugin for WordPress, which manages editorial and print production tasks, contains a security flaw that could allow logged-in users to access sensitive database information. By sending specially crafted requests, an attacker with even low-level 'Subscriber' permissions can bypass security controls to extract data they are not authorized to see. This could lead to the exposure of user credentials, site configuration details, or other private business data stored in the website's database.

Technical details

A time-based blind SQL injection vulnerability exists in the Eight Day Week Print Workflow plugin for WordPress due to insufficient escaping and lack of proper query preparation in the 'pp-get-articles' AJAX action. Specifically, the 'title' parameter is processed without adequate sanitization before being included in a database query. An authenticated attacker with Subscriber-level permissions or higher can exploit this by injecting malicious SQL commands to infer data from the database based on the time it takes for the server to respond. This vulnerability affects all versions up to and including 1.2.6. Users are advised to update to a patched version if available or restrict access to the affected AJAX functionality.

Affected products

  • Eight Day Week Eight Day Week Print Workflow Up to, and including, 1.2.6

Timeline

  • 2026-05-12: disclosed: Initial publication of the CVE record
  • 2026-05-12: advisory: Wordfence published the vulnerability details

References