CVE-2026-89234

Summary

The WP-Partner WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to inject malicious SQL queries and extract sensitive database information. This represents a significant risk as it can lead to data breaches and potential system compromise.

Exploitability

The vulnerability is relatively easy to exploit as it requires no authentication and allows attackers to append arbitrary SQL queries, with the main precondition being that the plugin is installed and active on a WordPress site.

Blast radius

If exploited, this vulnerability could impact all WordPress sites using WP-Partner plugin version 1.2.1 or earlier, potentially exposing sensitive user data, configuration settings, and other database contents to attackers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP-Partner plugin version 1.2.2 or later to remediate the SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.