CVE-2026-22850

CVE-2026-22850 is an arbitrary SQL execution vulnerability affecting Koko Analytics WordPress plugin versions prior to 2.1.3. Unauthenticated attackers can inject malicious SQL into analytics data via the tracking endpoint, which is then executed when an administrator imports a crafted export file. Authenticated users with manage_koko_analytics permissions can also directly upload and execute arbitrary SQL files. This vulnerability has a CVSS score of 8.3 (High), indicating a severe risk. It requires user interaction (UI:R) from an administrator to import the malicious data, but the attack can lead to complete compromise of the database (C:H, I:H, A:H), including data deletion or privilege escalation. The attack complexity is rated as High (AC:H) due to the multi-stage nature of the exploit. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.