Home / Vulnerability Intelligence / CVE-2026-31917

CVE-2026-31917 - Vulnerability Analysis

HighCVSS: 8.5

Last Updated: March 13, 2026

weDevs WP ERP - SQL Injection

Published: March 13, 2026Updated: March 13, 2026Remote Exploitable

Overview

weDevs WP ERP <= 1.16.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

Severity & Score

Severity: High

CVSS Score: 8.5

EPSS Score: 2.1%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or full database compromise.

Mitigation

Update to the latest version beyond 1.16.10.

References

https://patchstack.com/database/Wordpress/Plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-16-10-sql-injection-vulnerability?_s_id=cve

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🟠 CVE-2026-31917 - High (8.5) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31917/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-31917
Severity: High
CVSS Score: 8.5
Type: sql_injection
Status: new
EPSS: 2.1%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score

2.1%Probability of exploitation in the next 30 days