CVE-2026-57385

HighCVSS 8.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The Vitepos WordPress plugin contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 3.4.2.

Risk Assessment

An attacker can exploit this flaw to gain unauthorized access to the database, potentially stealing or modifying sensitive data, posing a serious risk to data confidentiality and integrity.

Recommendation

Immediately update the Vitepos plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.

Other vulnerabilities in Vitepos

CVE-2026-54841High
Versions of Vitepos up to 3.4.2 have a vulnerability that allows unauthorized access to sensitive data.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.