CVE-2026-89285
8.6 HIGHPublished 2026-10-11 · Updated 2026-10-13
AI risk analysis
- Summary
- The Datalist WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database data. This occurs because the plugin fails to sanitize request parameters before incorporating them into SQL queries.
- Exploitability
- Exploitation is straightforward for unauthenticated attackers with no special preconditions required, as the vulnerability exists in publicly accessible endpoints.
- Blast radius
- If exploited, attackers could access sensitive user data, configuration settings, and other database content that may include credentials or personal information.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 0.0.4 or later to remediate this SQL injection vulnerability.
sql-injectionwordpressunauthenticated
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-103695
- CRITICALCVE-2026-62031
- HIGHCVE-2026-6806
- HIGHCVE-2026-87781
- HIGHCVE-2026-88926
- HIGHCVE-2026-89195
- HIGHCVE-2026-89213
- HIGHCVE-2026-89214
Related by shared AI tags and CWE weakness class. Browse the full archive.