CVE-2026-32555 PixelYourSite Professional CVE debrief

Who should care

Defenders and security teams responsible for managing and securing WordPress plugins, particularly those using the Boost plugin, should assess exposure and prioritize remediation efforts.

Why it matters

CVE-2026-32555 is a critical unauthenticated SQL injection vulnerability in the Boost plugin. Defenders should assess exposure, prioritize remediation, and monitor for potential attacks. The vulnerability has a high CVSS score of 9.3, indicating a high severity level.

• Potential data breaches due to malicious SQL code injection
• System compromise through exploitation of this vulnerability
• Need for immediate remediation of vulnerable Boost plugin versions

Technical summary

The Boost plugin up to version 2.0.4 is vulnerable to unauthenticated SQL injection. This vulnerability has a CVSS score of 9.3 and is classified as critical. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Boost plugin versions up to 2.0.4
• Prioritize remediation efforts for vulnerable versions
• Monitor for potential SQL injection attacks

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The CVE Program and NIST National Vulnerability Database provide official information about this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.