CVE-2014-5182: Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated use...

Security readout for executives and security teams

CVE-2014-5182 is a SQL injection issue in the yawpp 1.2 WordPress plugin. A logged-in user with Contributor privileges could make the site run unintended database queries. That can threaten site content, user data, and integrity, but the source bundle does not show active exploitation. Exposure is likely limited to WordPress installations running yawpp plugin 1.2, especially where untrusted or lightly vetted users can hold Contributor privileges. The provided metadata does not identify broader affected versions or CPEs. Prioritize remediation for any public WordPress site using yawpp where Contributor accounts exist. The issue can affect database confidentiality and integrity, but urgency depends on whether the obsolete plugin is present and who has authenticated access. Mitigation focus: Inventory WordPress sites for the yawpp plugin and installed version.; Remove yawpp if it is unused or cannot be confirmed safe.; Check official WordPress plugin changelog and vendor guidance for fixed versions..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.