CVE-2026-2495

🗓️ 18 Feb 2026 08:26:03Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 7 Views🌐 WEB

Unauthenticated SQL injection via the order parameter in WPNakama boards endpoint up to version 0.6.5.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-2495	18 Feb 202608:26	–	attackerkb
Circl	CVE-2026-2495	18 Feb 202609:16	–	circl
CNNVD	WordPress plugin WPNakama SQL注入漏洞	18 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2495 WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter	18 Feb 202608:26	–	cvelist
NVD	CVE-2026-2495	18 Feb 202609:15	–	nvd
Patchstack	WordPress WPNakama plugin <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter vulnerability	18 Feb 202607:03	–	patchstack
Positive Technologies	PT-2026-20366	18 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2495	19 Feb 202613:28	–	redhatcve
Vulnrichment	CVE-2026-2495 WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter	18 Feb 202608:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 16, 2026 to February 22, 2026)	26 Feb 202616:02	–	wordfence

Vulners

Node

qdonow wpnakama_team_and_multi-client_collaboration,_editorial_and_project_managementRange≤0.6.5wordpress

[
  {
    "vendor": "qdonow",
    "product": "WPNakama – Team and multi-Client Collaboration, Editorial and Project Management",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "0.6.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wpnakama/trunk/inc/class-wpnakama-api.php
plugins	www.plugins.trac.wordpress.org/browser/wpnakama/tags/0.6.5/inc/class-wpnakama-api.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/wpnakama/tags/0.6.5/inc/class-wpnakama.php
plugins	www.plugins.trac.wordpress.org/browser/wpnakama/trunk/inc/class-wpnakama.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/7ffa92be-9d38-40d9-954d-d890136b5aa1

Parameter	Position	Path	Description	CWE
order	query param	/wp-json/WPNakama/v1/boards	SQL Injection via unsafely escaped 'order' parameter in the WPNakama boards REST endpoint.	CWE-89

15 Apr 2026 00:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00047

SSVC

CWE-89