CVE-2026-17017

Name of the Vulnerable Software and Affected Versions CubeWP Framework versions prior to 1.1.31

Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement via an AJAX action. Additionally, the action lacks a capability check, which allows users with Subscriber-level access and above to perform SQL injection attacks. The affected AJAX action is cubewp remove relation.

Recommendations Update CubeWP Framework to version 1.1.31 or later.