WordPress Plugin Vulnerabilities

Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

Description

The plugin does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the plugin's data.

Proof of Concept

Affects Plugins

Plugin icon
dinatur
No known fix

References

CVE
CVE-2026-12983

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
João Ramos Maciel and Theo Antonio da Fonseca
Submitter
João Ramos Maciel and Theo Antonio da Fonseca
Verified
Yes
WPVDB ID
1369f95a-4ad3-4b0e-a87f-da88d200685e

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-19 (about 9 hours ago)

Other

Published
Title
Published
2014-08-01
Title
VideoWhisper Video Presentation <= 1.1 - SQL Injection
Published
2024-08-01
Title
WP User Frontend < 4.0.8 - Authenticated (Administrator+) SQL Injection
Published
2026-07-08
Title
Booking for Appointments and Events Calendar – Amelia < 2.4.3 - Unauthenticated SQL Injection
Published
2023-10-03
Title
Copy Or Move Comments <= 5.0.4 - Authenticated (Subscriber+) SQL Injection
Published
2026-07-23
Title
Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form