CVE-2024-6928 is a critical severity (CVSS 9.8) SQL injection in the Opti Marketing WordPress plugin through version 2.0.9. It can be reached by visitors who are not logged in. WPScan lists 2.0.10 as the fixed version, so update to it or remove the plugin.
What's affected
The record says Opti Marketing through 2.0.9 is affected. WPScan's entry titles the issue as affecting versions before 2.0.10 and lists 2.0.10 as the fix. Those two statements describe the same boundary, since 2.0.9 is the last version below 2.0.10.
The severity differs between sources. The NVD record scores 9.8, critical, using CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. WPScan's entry gives 8.6, high. WPScan credits Project Black as the original researcher and marks the report as verified. Neither source suggests a different remedy, so the difference does not change what you should do.
The plugin slug is opti-marketing. The affected request is an AJAX action that the plugin registers for users who are not logged in. The description says a parameter is used in a SQL statement without proper sanitising and escaping.
The weakness is CWE-89, SQL injection.
How to check if you're exposed
With WP-CLI on the server:
wp plugin list --fields=name,status,version | grep -i opti
In the dashboard, open Plugins and find Opti Marketing. Any version at or below 2.0.9 is affected. Inactive plugins still leave files on disk, so delete the plugin if you are not using it.
Also look at what else is installed. A site with one plugin that trusts request values often has others. Run the same listing for every plugin and compare it with the WPScan database or a dependency scanner. The free scan at gold.safeguard.sh/scan is one way to check the application packages around the site.
What to do now
- Update Opti Marketing to 2.0.10 or later.
- If the plugin is unused, deactivate and delete it.
- Review the web server logs for repeated requests to the WordPress AJAX endpoint with unusual values, and look for slow responses that could point to probing.
- Check for new administrator users, new scheduled tasks, and altered site options.
- If there is any sign of misuse, reset passwords, rotate the WordPress salts, and change the database password.
Why it matters
A marketing plugin often stores visitor activity and campaign data, so the database behind it is rarely empty. SQL injection on an unauthenticated route is a serious position to be in, because the attacker needs no account and no click from a user.
The root cause is the standard one. The plugin joins a request value into a database query and does not use a prepared statement. WordPress ships helpers for exactly this, such as the prepare method on its database class, and the fix in a good plugin is to use them. The fix version should be tested on a staging copy before it goes to production, though the urgency argues for doing it the same day.
CISA does not list this CVE in its Known Exploited Vulnerabilities catalogue, and none of the sources say it has been exploited in the wild.
Quick check
Is version 2.0.9 safe?
No. The record says versions through 2.0.9 are affected. The fixed version is 2.0.10.
Does deactivating the plugin remove the risk?
It removes the registered action in normal operation, but deleting the plugin is safer because the files stay on disk when it is only deactivated.
Sources
Last reviewed: 19 October 2026.
