Wed, 06 May 2026 05:03:32 +0000
theresident, ehabhussein, cybersecurity, infosec, vulnerability, cve, hacking, security, CVE202622850

CVE-2026-22850: When Your Own Export File Comes Back As A Bomb
Koko Analytics, a WordPress analytics plugin, lets unauthenticated visitors plant SQL fragments into the analytics tables, then politely re-serves them as a `.sql` admin export, then runs whatever the admin re-uploads with `$wpdb->query()` — no allowlist, no statement filter, no escaping along the way.…