{"id":"CVE-2026-89216","kind":"vulnerability","aliases":["CVE-2026-89216"],"related":[],"title":"vTables WordPress plugin: unauthenticated SQL injection lets attackers read database","description":"The vTables  WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.","summary":"The vTables WordPress plugin before version 0.3 passes a request parameter into a SQL statement without sanitising or escaping it. An unauthenticated attacker can inject SQL and extract data from the site's database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","vtables","wordpress"],"not_affected_if":["plugin-not-installed","version-0.3-or-later"],"how_to_check":"- Check whether the vTables plugin is installed on the WordPress site (Plugins screen in wp-admin, or `wp plugin list` with WP-CLI).\n- Check the installed vTables version; versions below `0.3` are in the affected range.","fix":"- vTables: move to `0.3` or later (per the NVD description, the fix is in versions 0.3 and later).","status":"open","published_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","triaged_at":"2026-10-29T06:54:34+00:00","updated_at":"2026-10-29T06:54:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:34Z","model":"claude-haiku-5-5","output":{"fix":"- vTables: move to `0.3` or later (per the NVD description, the fix is in versions 0.3 and later).","reach":"internet","title":"vTables WordPress plugin: unauthenticated SQL injection lets attackers read database","impact":"medium","summary":"The vTables WordPress plugin before version 0.3 passes a request parameter into a SQL statement without sanitising or escaping it. An unauthenticated attacker can inject SQL and extract data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vtables"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads database contents, including user credentials and site data.","analyst_note":"Sources give only the NVD description; confirm the exact vulnerable endpoint and parameter and whether the fix in 0.3 is documented at https://nvd.nist.gov/vuln/detail/CVE-2026-89216.","how_to_check":"- Check whether the vTables plugin is installed on the WordPress site (Plugins screen in wp-admin, or `wp plugin list` with WP-CLI).\n- Check the installed vTables version; versions below `0.3` are in the affected range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-0.3-or-later"],"who_is_affected":"Only WordPress sites running the vTables plugin before 0.3 are exposed. The flaw is reachable without logging in, so any site with the plugin installed and reachable from the internet should be treated as exposed. Sites without the plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4096,"output_tokens":598,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-89216':13A,16A '0.3':26B,59C 'allow':76C 'attack':8A,42B,78C,83C 'cve':11A,14A 'data':48B,86C 'databas':10A,53B,89C 'escap':38B,65C 'extract':47B,85C 'inject':6A,44B,82C 'let':7A 'packag':17B 'paramet':30B,67C 'pass':27B 'perform':80C 'plugin':3A,23B,57C 'proper':62C 'read':9A 'request':29B 'sanitis':36B,63C 'site':51B 'sql':5A,33B,45B,73C,81C 'statement':34B,74C 'unauthent':4A,41B,77C 'use':69C 'version':25B 'vtabl':1A,18B,21B,55C 'without':35B 'wordpress':2A,19B,22B,56C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress sites running the vTables plugin before 0.3 are exposed. The flaw is reachable without logging in, so any site with the plugin installed and reachable from the internet should be treated as exposed. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89216","severity":null,"published_at":"2026-10-29T06:17:24+00:00","modified_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","fetched_at":"2026-10-29T06:53:14+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}