rootpwn

high · CVSS v3 8.6 · EPSS 0.00172

CVE-2026-89236

The SaveTo Wishlist Lite WordPress plugin (v<1.1.5) contains an unsanitized ORDER BY clause that allows unauthenticated attackers to inject

Overview

The SaveTo Wishlist Lite WordPress plugin (v<1.1.5) contains an unsanitized ORDER BY clause that allows unauthenticated attackers to inject SQL and exfiltrate database data. This flaw can be exploited without authentication, exposing sensitive content. The vulnerability is rated high severity with a CVSS v3 score of 8.6.

Description

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Impact

Confidentiality: attackers can read private database tables. Integrity: malicious queries could modify data. Availability: repeated injections may degrade performance. Defenders should treat this as a critical data exposure risk.

Remediation

Update the plugin to version 1.1.5 or later. If update is not possible, disable the plugin or restrict its database permissions. Implement input validation and use parameterized queries. Monitor database logs for suspicious ORDER BY patterns.

Risk context

Severity is high (CVSS 8.6) but EPSS is very low (0.00172), indicating limited current exploitation. Nonetheless, the flaw remains exploitable and should be patched promptly.

Affected products

  • WordPress
  • SaveTo Wishlist Lite

Scores

Severity
high
CVSS v2
7.8
CVSS v3
8.6
CVSS v4
—
EPSS
0.00172

sql-injection wordpress plugin database high-severity EPSS-low

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis