{"id":"CVE-2026-76005","kind":"vulnerability","aliases":["CVE-2026-76005"],"related":[],"title":"WP Inventory Manager: sort_order shortcode attribute allows SQL injection","description":"The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.","summary":"The WP Inventory Manager WordPress plugin up to and including 2.5.5 does not escape the sort_order attribute of its shortcodes before building a SQL query. A contributor-level user can append time-based SQL queries to extract data from the site database.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-inventory-manager"],"not_affected_if":["no-contributor-accounts","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of WP Inventory Manager in the WordPress admin plugins list or with `wp plugin get wp-inventory-manager --field=version`\n- Confirm whether any users hold the Contributor role or higher","fix":"- Update the WP Inventory Manager plugin to a version later than `2.5.5`\n- Unknown whether a fixed version is released; check the plugin page or NVD entry","status":"open","published_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:32:49+00:00","updated_at":"2026-10-28T07:32:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:32:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Inventory Manager plugin to a version later than `2.5.5`\n- Unknown whether a fixed version is released; check the plugin page or NVD entry","reach":"internet","title":"WP Inventory Manager: sort_order shortcode attribute allows SQL injection","impact":"medium","summary":"The WP Inventory Manager WordPress plugin up to and including 2.5.5 does not escape the sort_order attribute of its shortcodes before building a SQL query. A contributor-level user can append time-based SQL queries to extract data from the site database.","category":"package","nicknames":[],"who_cares":["wordpress","wp-inventory-manager","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with contributor account extracts sensitive database contents","analyst_note":"","how_to_check":"- Check the installed version of WP Inventory Manager in the WordPress admin plugins list or with `wp plugin get wp-inventory-manager --field=version`\n- Confirm whether any users hold the Contributor role or higher","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts","plugin-updated"],"who_is_affected":"Sites running WP Inventory Manager version 2.5.5 or earlier where users with Contributor role or above can create or preview posts containing the [wpinventory_categories] shortcode. Exploitation works on draft posts viewed through preview, so published-only setups are not a shield. Sites without this plugin, or without contributor-level accounts, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":3443,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-76005':13A,16A '2.5.5':36B,98C 'access':129C 'addit':134C 'allow':8A 'alreadi':138C 'append':58B,133C 'attack':124C 'attribut':7A,43B,90C 'authent':123C 'base':61B,83C 'build':48B 'categori':162C 'contributor':54B,127C,158C 'contributor-level':53B,126C 'cve':11A,14A 'data':66B 'databas':70B,151C 'draft':167C 'due':99C 'embed':164C 'escap':39B,102C 'exist':115C,139C 'exploit':155C 'extract':65B,146C 'host':20B 'includ':35B,97C 'inform':148C 'inject':10A,85C 'insuffici':101C 'inventori':2A,24B,28B,73C 'lack':109C 'level':55B,128C 'make':119C 'manag':3A,25B,29B,74C 'order':5A,42B,88C 'packag':17B 'paramet':107C 'plugin':31B,75C 'possibl':121C 'post':168C,175C 'prepar':112C 'preview':171C 'publish':178C 'queri':51B,63B,117C,136C,140C 'render':169C 'requir':173C 'self':19B 'self-host':18B 'sensit':147C 'shortcod':6A,46B,89C,163C 'site':69B 'sort':4A,41B,87C 'sql':9A,50B,62B,84C,116C,135C 'suffici':111C 'suppli':106C 'time':60B,82C 'time-bas':59B,81C 'use':144C 'user':56B,105C 'version':93C 'via':86C,159C 'vulner':79C 'without':172C 'wordpress':21B,30B,77C 'wp':1A,23B,27B,72C 'wp-inventory-manag':22B 'wpinventori':161C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Inventory Manager version 2.5.5 or earlier where users with Contributor role or above can create or preview posts containing the [wpinventory_categories] shortcode. Exploitation works on draft posts viewed through preview, so published-only setups are not a shield. Sites without this plugin, or without contributor-level accounts, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76005","severity":null,"published_at":"2026-10-28T07:16:48+00:00","modified_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}