# CVE-2026-96329: tagDiv Opt-In Builder SQL injection in td-subscription

Source: https://junglewise.ai/threats/cve-2026-96329-improper-neutralization-of-special-elements-used-in-an-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-96329 · Severity: high · CVSS 8.5 · Published 2026-10-09

The tagDiv Opt-In Builder is a WordPress plugin that creates opt-in forms for collecting subscriber email addresses. A SQL injection vulnerability allows attackers to inject malicious database commands, potentially exposing sensitive subscriber data or compromising the WordPress site's database without requiring authentication.

Technologies: [tagDiv Opt-In Builder](https://junglewise.ai/threats/technologies/tagdiv-opt-in-builder). Vendors: [tagDiv](https://junglewise.ai/threats/vendors/tagdiv).

## Quick answers

**Is CVE-2026-96329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96329 being exploited in the wild.

**How severe is CVE-2026-96329?** High severity, with a CVSS score of 8.5, published 9 October 2026.

**Which products and versions are affected?** tagDiv Opt-In Builder 1.7.6 and earlier.

**Is there a fix for CVE-2026-96329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96329 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96329?** Check whether you run tagDiv Opt-In Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The td-subscription component in tagDiv Opt-In Builder versions up to 1.7.6 contains an improper neutralization of SQL special characters, allowing blind SQL injection attacks. The vulnerability is network-accessible and does not require prior authentication or user interaction, enabling attackers to extract database contents or modify data through time-based or boolean-based blind SQL injection techniques.

## Affected products

- tagDiv Opt-In Builder 1.7.6 and earlier

## Timeline

- 2026-10-09: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/td-subscription/vulnerability/wordpress-tagdiv-opt-in-builder-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/td-subscription/vulnerability/wordpress-tagdiv-opt-in-builder-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [tagDiv Opt-In Builder SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-96330-improper-neutralization-of-special-elements-used-in-an-sql)
- [tagDiv Opt-In Builder DOM-based XSS in td-subscription](https://junglewise.ai/threats/cve-2026-57732-tagdiv-opt-in-builder-dom-based-xss-in-td-subscription)