CVE-2026-89288
CVE-2026-89288 · Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
CVSS 8.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
fast courier
- Versions
- ≥ 5.0.0, < 5.2.4: Affected (semver)
Update to 5.2.4