CVE-2026-57683
CriticalCVSS 9.3Summary
The WP Fast Total Search plugin version 1.80.280 and earlier contains an unauthenticated SQL injection vulnerability. An attacker without authentication can send crafted queries to the database.
Risk Assessment
An unauthenticated attacker can read, modify, or delete data from the WordPress database, including user data and content. This could lead to full site compromise.
Recommendation
Immediately update the WP Fast Total Search plugin to the latest available version. If an update is not possible, temporarily disable the plugin until a patch is released.
Other vulnerabilities in WP Fast Total Search
See all- CVE-2026-84821High
The WP Fast Total Search WordPress plugin in versions up to 1.82.284 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.
- CVE-2026-27418Medium
The WP Fast Total Search plugin for WordPress versions 1.81.282 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
Original NVD description (English source)
Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS