halfdata Green Popups Plugin Patched for Critical Blind SQL Injection Flaw
The WordPress plugin vendor released version 7.6.3 to fix a critical blind SQL injection vulnerability that affected all prior versions.
Key points
- CVE-2026-94388 is rated Critical with a CVSS score of 9.3.
- The flaw allows blind SQL injection attacks in versions before 7.6.3.
- The vendor has released a patched update to mitigate the risk.
halfdata released version 7.6.3 of its Green Popups WordPress plugin to address a critical security vulnerability. This update resolves a blind SQL injection flaw that had been present in all previous versions of the software.
At a glance
- CVE
- CVE-2026-94388
- Product
- halfdata Green Popups
- CVSS
- 9.3 Critical
- Weakness
- SQL injection
- Exploited
- No known exploitation
The National Vulnerability Database lists the issue as CVE-2026-94388 with a CVSS score of 9.3. This high severity rating reflects the potential for significant data compromise through improper neutralization of special elements in SQL commands.
Context and Background
The vulnerability stems from improper handling of user input within the plugin’s database queries. According to the NVD record, the weakness is classified under CWE-89, which covers SQL injection flaws. Attackers can exploit this gap to execute blind SQL injection attacks against vulnerable installations.
Blind SQL injection differs from standard injection because the attacker does not see the database results directly. Instead, they infer data by observing the application’s behavior or response times. This technique can still allow full database extraction if the attacker persists.
As Threat Times reported on 2026-10-15, SQL injection remains a persistent threat in the WordPress ecosystem. The Backuply plugin faced similar scrutiny for a second-order SQL injection that allowed privilege escalation. These incidents highlight the ongoing risk of database flaws in popular plugins.
Who Is Affected
Any WordPress site running halfdata Green Popups versions prior to 7.6.3 is affected by this vulnerability. The NVD record specifies that the issue impacts releases from the beginning of the plugin’s history up to the release of the patch.
Site administrators must verify their current version immediately. If the installed version is lower than 7.6.3, the site is exposed to potential blind SQL injection attacks. The vendor has confirmed that version 7.6.3 contains the necessary fixes to neutralize the threat.
Users who have not updated their plugins are at risk. The blind nature of the injection means automated scanners might not immediately detect active exploitation. Manual review of database integrity is recommended for older installations.
What should you do?
Administrators should update the Green Popups plugin to version 7.6.3 as soon as possible. This update closes the SQL injection vector described in CVE-2026-94388. Delaying the update leaves the site vulnerable to potential data breaches.
What to do and how to stay safe: halfdata
- Check your WordPress plugin dashboard for the latest version of Green Popups.
- Update the plugin to version 7.6.3 or higher to apply the security patch.
- Monitor database logs for unusual queries or unexpected changes in data.
- Review other plugins for similar SQL injection vulnerabilities using a security scanner.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-94388?
It is a critical blind SQL injection vulnerability in the halfdata Green Popups WordPress plugin.
Which versions are affected?
All versions of Green Popups before 7.6.3 are affected by this security flaw.
Is there a fix available?
Yes, the vendor released version 7.6.3 which patches the SQL injection vulnerability.
