Live › vulnerability › CVE-2026-89216
The vTables WordPress plugin before version 0.3 passes a request parameter into a SQL statement without sanitising or escaping it. An unauthenticated attacker can inject SQL and extract data from the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Only WordPress sites running the vTables plugin before 0.3 are exposed. The flaw is reachable without logging in, so any site with the plugin installed and reachable from the internet should be treated as exposed. Sites without the plugin can skip it.
No product ranges from the sources yet.
wp plugin list with WP-CLI).0.3 are in the affected range.0.3 or later (per the NVD description, the fix is in versions 0.3 and later).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-89216")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.