{"id":"CVE-2026-89287","published":"2026-10-11T07:17:28.560","lastModified":"2026-10-13T16:29:21.907","description":"The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9194818b-75c8-40f0-baba-6dc84d2cfe7d/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The ASPL Product Quotation WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database data. This occurs because the plugin fails to sanitize user input before incorporating it into SQL queries.","exploitability":"Exploitation is relatively straightforward as attackers need only send crafted parameters to the vulnerable endpoint without authentication, though they may need to perform some reconnaissance to identify the exact injection point.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive customer data, product information, and potentially administrative credentials stored in the WordPress database.","remediation":"Upgrade to version 1.1.1 or later which contains the SQL injection fix for the ASPL Product Quotation plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:57.348Z"}}