CVE-2026-89288

HighCVSS 8.6

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Risk Assessment

An attacker can access confidential information in the database, including customer data, orders, and other sensitive information.

Recommendation

Update the Fast Courier plugin to version 5.2.4 or later.

Other vulnerabilities in Fast Courier

CVE-2026-89289Medium
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

Original NVD description (English source)

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS