Critical SQL Injection Flaw Found in tagDiv Opt-In Builder Plugin

A critical security vulnerability has been identified in the tagDiv Opt-In Builder plugin, a popular tool used for creating subscription forms on WordPress websites. The flaw, assigned the identifier CVE-2026-96330, allows attackers to perform blind SQL injection attacks against sites running the affected software.

The vulnerability stems from improper neutralization of special elements used in SQL commands. According to the National Vulnerability Database (NVD), this issue is classified under CWE-89. The specific nature of the flaw is a blind SQL injection, which means an attacker can send a SQL query to the backend database and infer the results based on the application's behavior, even if the data is not directly displayed. This technique can be used to extract sensitive information, including user credentials, personal data, and other stored records, from the database.

Severity and Technical Context

The NVD has rated the severity of CVE-2026-96330 as critical, assigning it a Common Vulnerability Scoring System (CVSS) score of 9.3. This high score reflects the significant potential for damage and the ease with which the vulnerability can be exploited. SQL injection remains one of the most dangerous web application vulnerabilities because it can lead to complete database compromise. In the case of blind SQL injection, the attacker may need to craft specific queries and analyze response times or error messages to reconstruct the data, but the end result is the same: unauthorized access to sensitive information.

The vulnerability exists within the core functionality of the tagDiv Opt-In Builder plugin. The lack of proper input validation allows malicious SQL code to be executed by the database engine. This type of weakness is particularly prevalent in plugins that handle user-submitted data, such as subscription forms, where input fields are processed without adequate sanitization.

Affected Versions and Scope

The vulnerability affects the tagDiv Opt-In Builder plugin from its initial release through version 1.7.6. Any website running a version of the plugin that is 1.7.6 or older is considered vulnerable. The NVD record indicates that the issue affects versions "from n/a through 1.7.6," implying that no version prior to a potential fix has been immune to this specific flaw.

Site administrators who use the tagDiv Opt-In Builder for email marketing, newsletter sign-ups, or other subscription mechanisms need to verify their current plugin version immediately. If the installed version is 1.7.6 or lower, the site is exposed to potential exploitation. There is no indication in the current records that a patched version has been released or confirmed to resolve this specific CVE.

What should you do?

Given the critical nature of this vulnerability, site owners should take immediate steps to mitigate risk. While no official patch has been confirmed in the source material, general security practices apply to reduce the impact of such flaws.