CVE-2026-89195

Summary

The Site Setup Wizard WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to read database contents without needing any credentials. This occurs because user input is not properly sanitized before being used in database queries.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be performed through web requests, though it may need some reconnaissance to identify the vulnerable parameter.

Blast radius

The vulnerability could allow attackers to access sensitive site data including user credentials, configuration settings, and content, potentially affecting all sites using the vulnerable plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.5.9 or later which contains the SQL injection fix for the Site Setup Wizard plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.