CVE-2026-89232

Summary

The Recordbrowser WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to inject malicious SQL code and extract sensitive database information. This is particularly dangerous because no authentication is required to exploit it.

Exploitability

The exploit is relatively straightforward to execute as it requires no authentication, but may need the attacker to know the specific parameter being used in the vulnerable query.

Blast radius

If exploited, this vulnerability could lead to unauthorized access to sensitive user data, including potentially personal information and credentials stored in the WordPress database.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.8 or later which contains the fix for the SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.