CVE-2026-6453

The CubeWP Framework plugin for WordPress contains a SQL injection vulnerability in versions up to 1.1.30, allowing attackers to inject malicious SQL code. This occurs because the plugin does not properly sanitize user input in its cubewp_remove_relation() AJAX function, specifically when handling the relation_id parameter. The plugin's use of wp_unslash() to remove backslashes from the input data effectively disables WordPress's built-in SQL protection, leaving the input vulnerable to SQL injection. As a result, authenticated attackers with subscriber-level access or higher can append additional SQL queries to the existing query.

Based on public CVE data (MITRE/NVD).