Summary
CVE-2026-32555 is an unauthenticated SQL injection vulnerability in the Boost WordPress plugin (developed by PixelYourSite Professional), affecting all versions up to and including 2.0.4. The flaw allows a remote, unauthenticated attacker to inject arbitrary SQL commands into the underlying database. It carries a CVSS v3.1 base score of 9.3 (Critical).
Technical details
- Root cause: improper neutralization of special elements used in an SQL command (CWE-89), indicating user-supplied input is incorporated into a SQL query without adequate sanitization or parameterization.
- Attack vector: network-based; no authentication or user interaction is required to exploit (AV:N, PR:N, UI:N).
- Attack complexity is low, meaning the vulnerability can be exploited reliably without special conditions.
- Impact: the vulnerability scope is changed (S:C), high confidentiality impact (unauthorized data disclosure from the database) and low availability impact; no direct integrity impact is recorded.
- Classified under CAPEC-7 (Blind SQL Injection), suggesting exploitation may not return direct query output and instead relies on inferential/blind techniques.
Affected software
- Boost WordPress plugin (by PixelYourSite Professional): versions ≤ 2.0.4
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Mitigation and recommended actions
- Immediate: Upgrade the Boost plugin to a version newer than 2.0.4 as soon as the vendor releases a patched build. At the time of publication, no confirmed patched version has been verified from official sources.
- If no patch is yet available: Restrict or disable the Boost plugin on internet-facing WordPress sites until a fix is confirmed and applied.
- Deploy a web application firewall (WAF) rule to detect and block SQL injection patterns targeting the plugin’s endpoints.
- Monitor database and web server logs for anomalous or blind SQL injection probing behavior.
- Apply the principle of least privilege to the WordPress database account to limit the impact of a successful injection.

