CVE-2026-89299

Summary

The WP Verify API plugin has a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This is particularly dangerous because it can lead to data exposure and potential database compromise.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be performed through API endpoints, though it may require some reconnaissance to identify the exact vulnerable parameters.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive user data, modify database records, or potentially escalate to full database compromise affecting all WordPress site data.

Detection

Monitor for unusual SQL queries in database logs that contain user-supplied parameters, particularly those originating from API endpoints related to the WP Verify API plugin.

Prioritized remediation

Upgrade to version 1.0.1 or later which contains the SQL injection fix for the WP Verify API plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.