WordPress Plugin Vulnerabilities

Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

Description

The plugin does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
quentn-wp
Fixed in 1.2.15

References

CVE
CVE-2026-84113

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
359127b1-94a5-4007-94ac-a1d813b04ce0

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2026-04-29
Title
GD Rating System < 3.7 - Unauthenticated SQL Injection
Published
2014-08-01
Title
iCopyright(R) Article Tools <= 1.1.4 - SQL Injection
Published
2015-02-21
Title
Gallery Bank <= 3.0.101 - SQL Injection
Published
2025-01-22
Title
Product Table by WBW < 2.1.3 - Unuthenticated SQL Injection
Published
2026-08-13
Title
CubeWP < 1.1.31 - Authenticated (Subscriber+) SQL Injection