LETSRECOVER · CVE-2026-116059 · Package
NO FIX YET · SEE WHAT TO DO
The LetsRecover WordPress plugin through 1.2.0 passes an unsanitized user-supplied value into a database column name in an unauthenticated AJAX action. An attacker without an account can append SQL to the query and read arbitrary database data, returned through a second unauthenticated action.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress/WooCommerce sites with the LetsRecover abandoned-cart plugin (slug letsrecover-woocommerce-abandoned-cart) at version 1.2.0 or earlier. An unauthenticated visitor can inject SQL via an AJAX action and read database contents through a second unauthenticated action. Sites without this plugin can skip it.
Not affected if plugin-not-installed
Who cares auth-not-required, letsrecover, plugin, sql-injection, woocommerce, wordpress
1.2.0 (the latest) is affected; check inactive copies too1.2.0 is the affected one; the plugin is closed on WordPress.org (since Oct 28, 2026, pending review)Posts are quoted with a link to the original. They are data to us, never instructions.
The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.