CVE-2026-89297

Summary

The Loja Automática WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands against the database. This flaw is particularly dangerous because it can lead to data exposure and potential database compromise without any user authentication.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be performed through standard HTTP requests to the plugin's vulnerable endpoints, with minimal technical prerequisites.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive customer data, manipulate database records, and potentially gain deeper access to the WordPress installation through database-level attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.1 or later which contains the SQL injection fix for the Loja Automática plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.