Root cause analysis of CVE-2026-95870 in wpForo Forum, where a public custom-field search put a regex-escaped value into SQL and let an unauthenticated attacker extract WordPress password hashes.

Introduction: SQL Injection (SQLi) remains one of the most pervasive and dangerous application-layer vulnerabilities, accounting for a massive share of real-world data breaches. Despite decades of documented defense standards, legacy application architecture, insecure coding practices, and improper input sanitization continue to expose enterprise relational database management systems (RDBMS) to unauthorized data extraction, database destruction, and remote command execution. Understanding both offensive exploitation techniques and robust defensive controls is essential for securing modern enterprise infrastructures against SQLi threats.

Exploiting a database leak combined with weak MD5 password hashing to gain admin access.

Introduction: In modern web applications, individual security flaws often seem low-to-medium risk when evaluated in isolation. However, when an attacker chains multiple vulnerabilities—such as SQL Injection (SQLi), broken password reset logic, Insecure Direct Object References (IDOR), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF)—the cumulative impact frequently leads to complete system compromise. Understanding how these distinct vulnerability vectors interact allows security professionals and developers to design robust defense-in-depth controls across application logic, database interfaces, and session management.

Metabase said that after it discovered the attack, it immediately blocked the exploited endpoints, patched the vulnerability, terminated relevant sessions, and revoked credentials used in the incident. Metabase Cloud…