Live › vulnerability › CVE-2026-76005
Go to dashboardThe WP Inventory Manager WordPress plugin up to and including 2.5.5 does not escape the sort_order attribute of its shortcodes before building a SQL query. A contributor-level user can append time-based SQL queries to extract data from the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running WP Inventory Manager version 2.5.5 or earlier where users with Contributor role or above can create or preview posts containing the [wpinventory_categories] shortcode. Exploitation works on draft posts viewed through preview, so published-only setups are not a shield. Sites without this plugin, or without contributor-level accounts, are not exposed.
No product ranges from the sources yet.
wp plugin get wp-inventory-manager --field=version2.5.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.
This page as .md · .json · in your agent: get_signal("CVE-2026-76005")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.