Junglewise Threat Intelligence

CVE-2026-6453: CubeWP Framework SQL injection in cubewp_remove_relation

CVE-2026-6453 · Severity: medium · CVSS 6.5 · Published 2026-08-01

Executive brief

The CubeWP Framework plugin for WordPress, which is used to build complex websites and custom content types, contains a security flaw that could allow logged-in users to access unauthorized data. By exploiting this vulnerability, an attacker with basic account access (such as a subscriber) could run custom database commands. This could lead to the exposure of sensitive information stored in the website's database.

Technical details

The vulnerability is a classic SQL injection (CWE-89) located within the cubewp_remove_relation() AJAX function of the CubeWP Framework plugin. The root cause is the improper handling of the 'relation_id' parameter; the code uses wp_unslash() on the input, which removes the default backslash escaping provided by WordPress's magic quotes, and then interpolates the result directly into a raw SQL query without using $wpdb->prepare(). While sanitize_text_field() is subsequently applied, it does not provide protection against SQL injection. An authenticated attacker with at least subscriber-level privileges can exploit this via a network request to execute arbitrary SQL commands. The issue is addressed in versions following 1.1.30.

Affected products

  • cubewp1211 CubeWP Framework up to and including 1.1.30

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References