CVE-2026-89299

HighCVSS 8.6

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The WP Verify API WordPress plugin through version 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query. This allows unauthenticated users to perform SQL injection attacks.

Risk Assessment

An unauthenticated attacker can inject arbitrary SQL queries and read or modify data in the WordPress database, including user data and configuration.

Recommendation

Update the WP Verify API plugin to a version newer than 1.0.0 or disable it if no fix is available. Consider auditing the database for unauthorized changes.

Other vulnerabilities in WP Verify API WordPress plugin

CVE-2026-89300Medium
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

Original NVD description (English source)

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS