Open-source business platforms, week 43: high-severity Frappe SQL injection among four vulnerabilities

The release at a glance

Between 19 and 25 October 2026, the maintainers of Frappe, Dolibarr and WordPress published four vulnerability entries. Three carry CVE identifiers, and one is the GitHub security advisory GHSA-7cxg-q8x5-rpjh. Two of the entries affect Frappe, one affects Dolibarr, and one affects WordPress. By severity, the set contains one high-rated issue and three medium-rated issues. No entry in the set is listed in CISA's Known Exploited Vulnerabilities catalogue, and none is marked as exploited. The most serious item is CVE-2026-114664, a blind SQL injection in Frappe Framework's get_events function.

What matters most

Frappe has two entries. CVE-2026-114664 is a high-severity blind SQL injection in frappe.desk.doctype.event.event.get_events affecting Frappe Framework before 16.33.0. It carries a CVSS 4.0 score of 7.1. An authenticated attacker can send crafted input to infer query results from application behaviour and extract sensitive database information. The fixed version is 16.33.0. The second Frappe entry, GHSA-7cxg-q8x5-rpjh, is a broken access-control flaw in File list and report queries. It can disclose private-file metadata and affects Frappe Framework before 16.35.0 and before 15.121.1. The maintainers' advisory states there are no workarounds; fixed versions are 16.35.0 and 15.121.1.

Dolibarr CVE-2026-112361 affects Dolibarr 23.0.0 through 23.0.2. It describes a protection-mechanism failure involving an unspecified function in htdocs/document.php within the CSP component. The attack can be executed remotely. Upgrading to Dolibarr 24.0.0 is sufficient to resolve it.

WordPress CVE-2026-114570 is a stored cross-site scripting flaw via Quick Edit. The advisory title refers to WordPress Core up to and including 7.0.2, while the affected version list in the CVE record covers the 4.7.0 through 5.4.19 branches. An authenticated user with Contributor-level access or above can inject scripts that execute when a higher-privileged user opens affected administrative screens. This issue only affects sites with a large number of users. No fixed version is listed.

Patch in this order

1. Patch Frappe Framework first. Upgrade from any version before 16.33.0 to 16.33.0 or later to close CVE-2026-114664, the high-severity blind SQL injection.

1. Complete the Frappe update path. For GHSA-7cxg-q8x5-rpjh, move to 16.35.0 on the 16.x branch or 15.121.1 on the 15.x branch. The maintainers give no workaround, so the update is the control.

1. Update Dolibarr to 24.0.0. This resolves CVE-2026-112361, a remotely exploitable protection-mechanism failure.

1. For WordPress, no fixed version is listed for CVE-2026-114570. Track Wordfence's advisory and review Contributor-level account assignments and administrative screens, especially on sites with a large number of users.

Beyond the patch

Open-source business applications patch on each maintainer's schedule, so a mixed estate such as Frappe, Dolibarr and WordPress rewards a disciplined upgrade path and a sharp view of supplier fix speed. Implementation & Assessment Services can test the Frappe and Dolibarr changes for injection, access-control and input-handling regressions before you deploy them. Supply Chain Defense & Third-Party Risk helps you track which versions you run and how quickly each project publishes fixes, which sets your exposure window.