{"id":"CVE-2026-89297","published":"2026-10-11T07:17:28.670","lastModified":"2026-10-13T16:29:21.907","description":"The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/590abff1-6ffd-48ce-a722-12655ab78a7a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Loja Automática WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands against the database. This flaw is particularly dangerous because it can lead to data exposure and potential database compromise without any user authentication.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed through standard HTTP requests to the plugin's vulnerable endpoints, with minimal technical prerequisites.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive customer data, manipulate database records, and potentially gain deeper access to the WordPress installation through database-level attacks.","remediation":"Upgrade to version 1.0.1 or later which contains the SQL injection fix for the Loja Automática plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","web","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:52.387Z"}}