CVE-2026-91074 BSK PDF Manager CVE debrief

Who should care

Defenders responsible for WordPress installations with the BSK PDF Manager plugin should assess exposure and prioritize verification of the plugin version and monitoring for potential SQL injection attacks.

Why it matters

The BSK PDF Manager WordPress plugin vulnerability could allow authenticated users to perform SQL injection attacks and read sensitive data, requiring defenders to verify the plugin version and monitor for potential attacks.

• Potential SQL injection attacks
• Read sensitive data such as administrator password hashes

Technical summary

The BSK PDF Manager WordPress plugin through 3.8.1 is vulnerable to SQL injection attacks due to improper sanitization and escaping of a parameter in a SQL statement. This could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database. Defenders should prioritize verifying the version of the plugin and ensuring that it is up-to-date, as well as monitoring for potential SQL injection attacks and restricting access to sensitive data.

Defensive priority

Defenders should prioritize verifying the version of the BSK PDF Manager WordPress plugin and ensuring that it is up-to-date, as well as monitoring for potential SQL injection attacks.

Recommended defensive actions

• Verify the version of the BSK PDF Manager WordPress plugin and ensure it is up-to-date
• Monitor for potential SQL injection attacks
• Restrict access to sensitive data such as administrator password hashes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Defenders should consult the vendor and additional sources for further details, focusing on verifying the plugin version, monitoring for potential SQL injection attacks, and restricting access to sensitive data. The lack of detailed information necessitates a cautious approach, emphasizing the need for thorough verification and continuous monitoring.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.