{"id":"CVE-2026-89299","published":"2026-10-11T07:17:28.770","lastModified":"2026-10-13T16:29:21.907","description":"The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e8aad431-35f1-41bc-aba0-d9579f5eee3f/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Verify API plugin has a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This is particularly dangerous because it can lead to data exposure and potential database compromise.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed through API endpoints, though it may require some reconnaissance to identify the exact vulnerable parameters.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive user data, modify database records, or potentially escalate to full database compromise affecting all WordPress site data.","remediation":"Upgrade to version 1.0.1 or later which contains the SQL injection fix for the WP Verify API plugin.","detection":"Monitor for unusual SQL queries in database logs that contain user-supplied parameters, particularly those originating from API endpoints related to the WP Verify API plugin.","tags":["sql-injection","wp-plugin","unauthenticated","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:47.067Z"}}