CVE-2026-66594 is a SQL injection in a WordPress persistent login plugin, reachable by subscriber-level accounts — the lowest privilege tier in WordPress. The CVSS 8.5 rating likely understates the real-world impact because it treats SQL injection uniformly without accounting for where the injection lands in the application's trust model. Persistent login plugins manage token-based authentication: they create, store, retrieve, and invalidate remember-me tokens across sessions. If the vulnerable code path is in token generation or validation logic — rather than peripheral database operations — an attacker with subscriber access can extract or manipulate authentication tokens belonging to administrators and other privileged users directly from the database.
This changes the attack calculus significantly. A subscriber-reachable SQL injection in authentication-adjacent code doesn't compromise one account; it opens the entire token store. WordPress sites frequently allow open registration, meaning anyone can create a subscriber account and reach the vulnerable query. The attacker harvests tokens for privileged users, then authenticates without needing admin credentials, phishing, or credential stuffing. The EPSS score of 0.00342 reflects current weaponization rates, but authentication-adjacent SQL injections in WordPress plugins historically become mass-exploited within 48-72 hours of disclosure as scanners integrate them, followed by weaponized exploit packs within a week.
Critical remediation steps beyond patching: audit whether subscriber registration is necessary and disable it if not. After applying the patch, rotate every persistent login token in the database — a SQL injection fix does not invalidate tokens extracted during the vulnerability window. Plugins in this category often implement 'forever plus a day' token expiration, meaning stolen tokens can remain valid long after the CVE is closed. If the plugin offers a token invalidation or 'remember me' feature reset, use it site-wide. Review access logs for subscriber accounts making abnormal database query patterns, since post-breach access by a token-extracting attacker will look like legitimate administrator sessions and may evade standard incident response timelines.