{"id":"CVE-2026-89302","published":"2026-10-11T07:17:28.873","lastModified":"2026-10-13T16:29:21.907","description":"The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/27dda3f8-1221-4710-bced-229577d20977/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Post Voting System WordPress plugin allows unauthenticated users to inject malicious SQL code into database queries due to insufficient input sanitization, potentially leading to unauthorized data access or manipulation.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed via crafted HTTP requests to the plugin's endpoints, with minimal preconditions beyond the plugin being installed and active.","blast_radius":"If exploited, attackers could gain access to sensitive user data, including voting records and potentially other WordPress database contents, affecting all sites running the vulnerable plugin version.","remediation":"Upgrade to version 1.1 or later to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:41.556Z"}}