PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3781 tnomi CVE debrief

The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This vulnerability allows authenticated attackers with Subscriber-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The CVSS score of 5.4 indicates a medium severity, and defenders should prioritize patching or mitigating this vulnerability.

Vendor
tnomi
Product
Attendance Manager
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Authenticated attackers with Subscriber-level access and above may be able to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where sensitive information is stored in the database.

Technical summary

The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability has a CVSS score of 5.4, indicating a medium severity.

Defensive priority

Medium priority given the CVSS score of 5.4 and the potential for sensitive information disclosure.

Recommended defensive actions

  • Inventory and verify the Attendance Manager plugin version
  • Apply vendor remediation or patch
  • Implement compensating controls such as web application firewalls
  • Monitor for suspicious database activity
  • Perform regular security audits and vulnerability assessments
  • Review system logs for potential SQL injection attempts
  • Verify the integrity of database queries and parameters

Evidence notes

Evidence is based on the CVE record and NVD detail. The CVE record was published on 2026-04-08T07:16:22.067Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Defenders should verify the Attendance Manager plugin version and review system logs for potential SQL injection attempts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3781 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3781

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3781 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3781

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.