CVE-2026-8978

Name of the Vulnerable Software and Affected Versions OptinCraft – Drag & Drop Optins & Popup Builder for WordPress versions prior to 1.2.1

Description The plugin is subject to generic SQL Injection, a flaw where an attacker can interfere with the queries that an application makes to its database. This occurs via the order by parameter due to insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict access to the functionality utilizing the order by parameter to minimize the risk of exploitation.