WordPress Plugin Vulnerabilities

Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
term-pages
Fixed in 2.0.0

References

CVE
CVE-2026-16949

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
3e07356a-5ac8-4d9f-bef2-65aaecbf1419

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2025-07-11
Title
URL Shortener <= 3.0.7 - Unauthenticated SQL Injection
Published
2024-08-07
Title
GeoDirectory < 2.3.62 - Authenticated (Subscriber+) SQL Injection
Published
2025-01-07
Title
Google Maps Travel Route <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
Published
2017-12-10
Title
RegistrationMagic - Custom Registration Forms < 3.8.0.9 - Authenticated SQL Injection
Published
2026-01-07
Title
Ninja Tables < 5.2.5 - Authenticated (Contributor+) SQL Injection