CVE-2026-84047

Name of the Vulnerable Software and Affected Versions Album Cover Finder versions prior to 0.7.1

Description The Album Cover Finder WordPress plugin fails to properly sanitize and escape the and action parameter before incorporating it into a SQL query. This flaw allows unauthenticated users to execute SQL injection attacks, which involve inserting malicious SQL code into a query to manipulate the database.

Recommendations Update the plugin to a version newer than 0.7.0. As a temporary workaround, restrict access to the and action parameter until the update is applied.