CVE-2026-89216
CVE-2026-89216 · vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
CVSS 8.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
vtables
- Versions
- ≥ 0, < 0.3: Affected (semver)
Update to 0.3