{"id":"CVE-2026-89234","published":"2026-10-11T07:17:28.217","lastModified":"2026-10-13T16:29:21.907","description":"The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/aad77794-bfe5-4ea6-a5b2-82c259140cae/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP-Partner WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to inject malicious SQL queries and extract sensitive database information. This represents a significant risk as it can lead to data breaches and potential system compromise.","exploitability":"The vulnerability is relatively easy to exploit as it requires no authentication and allows attackers to append arbitrary SQL queries, with the main precondition being that the plugin is installed and active on a WordPress site.","blast_radius":"If exploited, this vulnerability could impact all WordPress sites using WP-Partner plugin version 1.2.1 or earlier, potentially exposing sensitive user data, configuration settings, and other database contents to attackers.","remediation":"Upgrade to WP-Partner plugin version 1.2.2 or later to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:06:15.209Z"}}