CVE-2026-89213

Summary

The Llavero.io WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to read database information without needing any credentials or privileges. This flaw exists due to insufficient sanitization of user input before incorporating it into SQL queries.

Exploitability

Exploitation is straightforward with no authentication required, though it may need a few attempts to identify the vulnerable parameter and construct the payload.

Blast radius

If exploited, attackers could access sensitive database records including user credentials, posts, pages, and plugin configuration data that might reveal additional attack vectors.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.1.5 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.