CVE-2018-16159: WordPress Gift Vouchers plugin SQL injection via template_id

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, a public exploit, and a high EPSS score make this an urgent risk for exposed WordPress sites.

What it is

The Gift Vouchers plugin for WordPress through version 2.0.1 passes the template_id parameter from an unauthenticated admin-ajax.php wpgv_doajax_front_template request into a SQL query without proper sanitization. This allows an attacker to inject arbitrary SQL, potentially reading or modifying the underlying database. The flaw is rated critical (CVSS 9.8) and has a public exploit, making it a serious risk for any site running the affected plugin.

Impact

An attacker can read, alter, or delete data in the WordPress database, including user credentials and site content, and may be able to escalate to full site compromise depending on database privileges.

Attack surface

The vulnerability is reached remotely over HTTP through wp-admin/admin-ajax.php with the wpgv_doajax_front_template action and a crafted template_id parameter. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

The record is not listed in CISA KEV, but EPSS is high (0.499 probability, 98.8th percentile) and a public Exploit-DB entry exists, indicating active interest and available exploit code.

What to do

• Update the Gift Vouchers plugin to a version later than 2.0.1 if one is available, or remove the plugin if it is no longer maintained.
• If patching is not immediately possible, disable or restrict access to the wpgv_doajax_front_template AJAX action.
• Deploy a web application firewall rule to block SQL injection patterns targeting the template_id parameter.
• Audit the WordPress database and user accounts for signs of tampering or unauthorized changes.
• Apply least-privilege database permissions to the WordPress database user to limit the impact of SQL injection.

Detection

• Monitor web server and WAF logs for requests to wp-admin/admin-ajax.php with the wpgv_doajax_front_template action and suspicious template_id values.
• Search for SQL injection indicators such as UNION, SELECT, or comment sequences in the template_id parameter.
• Review database query logs for anomalous queries originating from the WordPress application.
• Check for unexpected changes to WordPress users, options, or content that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.