CVE-2026-89287

Summary

The ASPL Product Quotation WordPress plugin has a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database data. This occurs because the plugin fails to sanitize user input before incorporating it into SQL queries.

Exploitability

Exploitation is relatively straightforward as attackers need only send crafted parameters to the vulnerable endpoint without authentication, though they may need to perform some reconnaissance to identify the exact injection point.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive customer data, product information, and potentially administrative credentials stored in the WordPress database.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.1 or later which contains the SQL injection fix for the ASPL Product Quotation plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.