CVE-2026-17607
MediumCVSS 6.5Summary
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
An attacker could access confidential data stored in the WordPress database, such as passwords, user data, or content. This may lead to compromise of system integrity and confidentiality.
Recommendation
Update the WP Inventory Manager plugin to the latest available version that includes the fix. Restrict access to high-privilege accounts and regularly audit plugin SQL queries.
Other vulnerabilities in WP Inventory Manager
See all- CVE-2026-90887High
An unauthenticated Cross-Site Scripting (XSS) vulnerability in WP Inventory Manager versions ≤ 2.5.4 allows attackers to execute scripts in the victim's browser without authentication.
- CVE-2026-57772High
The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.
Original NVD description (English source)
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->get_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.