CVE-2026-89236

Summary

The flaw lies in the SaveTo Wishlist Lite WordPress plugin, which fails to properly sanitize parameters used in SQL queries, allowing unauthenticated attackers to inject additional SQL commands and potentially extract sensitive data.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be executed by appending malicious SQL commands to the query parameters.

Blast radius

If exploited, the impact could be significant, as it allows attackers to extract sensitive information from the database, potentially leading to data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.5 or later of the SaveTo Wishlist Lite plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.