CVE-2026-57772
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.
Risk Assessment
An attacker can exploit this vulnerability to read, modify, or delete data from the WordPress database, potentially compromising the confidentiality and integrity of the organization's data.
Recommendation
Immediately update the WP Inventory Manager plugin to the latest available version that includes a fix for the SQL injection vulnerability.
Other vulnerabilities in WP Inventory Manager
See all- CVE-2026-90887High
An unauthenticated Cross-Site Scripting (XSS) vulnerability in WP Inventory Manager versions ≤ 2.5.4 allows attackers to execute scripts in the victim's browser without authentication.
- CVE-2026-17607Medium
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS