CVE-2026-115224

{
  "etk_id": "ETK-2026-2844",
  "cve_id": "CVE-2026-115224",
  "display_id": "CVE-2026-115224",
  "ghsa_id": "GHSA-66pc-wp83-p27g",
  "euvd_id": "EUVD-2026-111729",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Customer Engagement System WordPress plugin",
  "summary": "Customer Engagement System WordPress plugin versions before 2.0.2 are affected by SQL injection when saving popup page or category visibility rules. An authenticated administrator could use the flaw to run unauthorized database queries and read WordPress database contents.",
  "mitigation": "Upgrade the Customer Engagement System WordPress plugin to version 2.0.2 or later. Restrict administrator access to trusted users until the update is installed.",
  "vendor": null,
  "product": "Customer Engagement System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.0.2"
      ],
      "package_name": "Customer Engagement System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 46.972143,
  "t0_at": "2026-10-28T06:00:26.878000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T08:51:12.438359+00:00",
      "days": 0.11858287452546297,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T06:00:26.878000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T06:00:26.878000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T06:00:26.878000+00:00",
      "url": "https://github.com/advisories/GHSA-66pc-wp83-p27g"
    }
  }
}