CVE Catalog
CVE-2026-14189
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
The WPBot WordPress plugin before version 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query. Users with administrator access can perform SQL injection that executes when a visitor triggers a search.
Risk Assessment
An administrator can execute malicious SQL queries, leading to data leakage or database corruption.
Recommendation
Update the WPBot plugin to version 8.5.2 or later.
Original NVD description (English source)
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.