CVE-2026-16586

CVE-2026-16586 is a second-order SQL injection in a WordPress plugin's MultipleFiles component, and the CVSS 6.5 rating badly understates the actual risk. The vulnerability works like this: the 'cgRealId' parameter under 'cg_multiple_files_for_post' accepts and stores a malicious payload during a first request—this storage phase is gated by author-level authentication, which creates a false sense of protection. But the payload only detonates during a subsequent, separate operation when the plugin retrieves that stored value and concatenates it into an existing query. That execution phase has no access control at all; it fires whenever normal plugin workflows trigger the retrieval, regardless of who triggered them. The author-gate only limits who can plant the payload, not who triggers its execution. In the WordPress ecosystem, author accounts are routinely provisioned to guest contributors, agency staff, and automation pipelines—treating this as a meaningful credential barrier is a mistake. The blast radius isn't determined by who plants or triggers the exploit in isolation. It's determined by what the compromised query connects to. If this plugin shares a database with WooCommerce, a membership system, or payment processing, the injection can reach user tables, session data, and payment tokens. The query path defines the blast radius, not the authentication gate. Forensically, examine whether version 30.0.8 implemented prepared statements specifically in the MultipleFiles retrieval function, or whether the developer used input validation at the storage endpoint. The latter would leave the structural vulnerability intact—just relocated. A surgical patch that parameterizes only one retrieval path while leaving other code paths accessing the same stored values unpatched is the expected pattern in WordPress plugin security, not a red flag. But it does mean you should audit every code path that retrieves previously-stored user-controlled values in this plugin; the fix closed one instantiation without addressing the underlying architectural assumption that stored data is inherently trusted. The EPSS score of 0.00328 is unreliable for decision-making. Second-order SQL injection in WordPress plugins consistently outperforms CVSS predictions in real-world exploitation data, partly because the execution phase looks like normal application behavior and evades detection. The 2026 dating means scoring algorithms lack historical context for this plugin's exploitation patterns. Treat the probability estimate as uncalibrated until real-world data accumulates post-disclosure.

Reviewed through automated stages and approved by a human before publication.