{"id":"CVE-2026-89213","published":"2026-10-11T07:17:27.840","lastModified":"2026-10-13T16:29:21.907","description":"The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/3f190943-997c-4b94-b760-51532b61427f/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Llavero.io WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to read database information without needing any credentials or privileges. This flaw exists due to insufficient sanitization of user input before incorporating it into SQL queries.","exploitability":"Exploitation is straightforward with no authentication required, though it may need a few attempts to identify the vulnerable parameter and construct the payload.","blast_radius":"If exploited, attackers could access sensitive database records including user credentials, posts, pages, and plugin configuration data that might reveal additional attack vectors.","remediation":"Upgrade to version 0.1.5 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:06:30.256Z"}}