CVE-2026-89302

Summary

The Post Voting System WordPress plugin allows unauthenticated users to inject malicious SQL code into database queries due to insufficient input sanitization, potentially leading to unauthorized data access or manipulation.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be performed via crafted HTTP requests to the plugin's endpoints, with minimal preconditions beyond the plugin being installed and active.

Blast radius

If exploited, attackers could gain access to sensitive user data, including voting records and potentially other WordPress database contents, affecting all sites running the vulnerable plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1 or later to remediate the SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.