e107 CMS Patched Critical Unauthenticated SQL Injection in Alt Auth Plugin
e107 version 2.3.7 fixes a critical flaw allowing unauthenticated attackers to inject SQL via the alt_auth plugin’s database backends.
Key points
- CVE-2026-55572 allows unauthenticated SQL injection in e107 versions prior to 2.3.7.
- The flaw exists in the alt_auth plugin’s otherdb and e107db authentication backends.
- Attackers can expose or modify data accessible to the configured database account.
e107 has released version 2.3.7 to address CVE-2026-55572, a critical SQL injection vulnerability. The National Vulnerability Database rates the issue with a CVSS score of 10, indicating severe risk. The flaw allows unauthenticated users to perform SQL injection attacks against installations using specific authentication plugins.
At a glance
- CVE
- CVE-2026-55572
- Product
- e107inc e107
- CVSS
- 10 Critical
- Weakness
- SQL injection
- Exploited
- No known exploitation
The vulnerability stems from how the bundled alt_auth plugin handles login credentials. Specifically, the otherdb and e107db authentication backends interpolate submitted usernames directly into SQL queries. This occurs within the files e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login methods execute these strings using PDO::query() before any effective sanitization takes place.
Technical Context and Impact
According to the NVD record, the weakness is classified under CWE-89, which covers SQL injection. Because the input is not sanitized before execution, an attacker can manipulate the database queries. This manipulation can expose or modify any data available to the database account configured for the plugin. The risk is present only when the alt_auth plugin is installed and one of the vulnerable backends is active.
The impact extends beyond simple data theft. Query failures resulting from the injection can disclose the generated SQL query through the application’s debug-message path. This information leakage can assist attackers in refining their exploits. The issue affects all e107 installations running versions earlier than 2.3.7 that have the specific plugin configuration enabled.
Affected Systems and Conditions
Only e107 content management system installations are affected by this specific CVE. The vendor, e107inc, has identified the issue in versions prior to 2.3.7. The vulnerability is not present in the core CMS by default but requires the installation of the alt_auth plugin. Furthermore, the plugin must be configured to use either the otherdb or e107db backend with a live external database connection for the flaw to be exploitable.
Administrators should verify if their systems have this plugin enabled. If the alt_auth plugin is not installed, the system is not vulnerable to CVE-2026-55572. The NVD record confirms that version 2.3.7 includes the fix for this injection flaw. Users running older versions must upgrade to mitigate the risk of unauthenticated database manipulation.
What should you do?
Administrators should immediately check their e107 version and plugin status. If running a version older than 2.3.7, they should upgrade to the patched release. Those who cannot upgrade immediately should disable the alt_auth plugin or its vulnerable backends. Monitoring database logs for unusual query patterns can help detect exploitation attempts.
What to do and how to stay safe: e107
- Verify your e107 CMS version and upgrade to 2.3.7 or later if you are running an older release.
- Disable the alt_auth plugin if it is not strictly required for your authentication workflow.
- Review database logs for unexpected query failures or unusual SQL syntax that may indicate injection attempts.
- Ensure that your web application firewall rules cover common SQL injection patterns to add a layer of defense.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-55572?
The National Vulnerability Database assigns a CVSS score of 10, categorizing it as critical.
Which specific files contain the vulnerable code?
The flaw is located in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php.
Is authentication required to exploit this vulnerability?
No, the source material states that an unauthenticated user can inject SQL into the system.
