CVE-2026-57385
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Vitepos WordPress plugin contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 3.4.2.
Risk Assessment
An attacker can exploit this flaw to gain unauthorized access to the database, potentially stealing or modifying sensitive data, posing a serious risk to data confidentiality and integrity.
Recommendation
Immediately update the Vitepos plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Vitepos
See all- CVE-2026-105076High
The Vitepos plugin (by Appsbd) up to version 3.6.1 contains a Blind SQL Injection vulnerability that allows an attacker to manipulate database queries.
- CVE-2026-96815High
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
- CVE-2026-54841High
Versions of Vitepos up to 3.4.2 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS