CVE-2026-3781 tnomi CVE debrief

Who should care

Authenticated attackers with Subscriber-level access and above may be able to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where sensitive information is stored in the database.

Technical summary

The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability has a CVSS score of 5.4, indicating a medium severity.

Defensive priority

Medium priority given the CVSS score of 5.4 and the potential for sensitive information disclosure.

Recommended defensive actions

• Inventory and verify the Attendance Manager plugin version
• Apply vendor remediation or patch
• Implement compensating controls such as web application firewalls
• Monitor for suspicious database activity
• Perform regular security audits and vulnerability assessments
• Review system logs for potential SQL injection attempts
• Verify the integrity of database queries and parameters

Evidence notes

Evidence is based on the CVE record and NVD detail. The CVE record was published on 2026-04-08T07:16:22.067Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Defenders should verify the Attendance Manager plugin version and review system logs for potential SQL injection attempts.

Official resources