WordPress Plugin Vulnerabilities

Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter

Description

The plugin does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
loja-automatica
No known fix

References

CVE
CVE-2026-89297

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
590abff1-6ffd-48ce-a722-12655ab78a7a

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2014-08-01
Title
WP DS FAQ <= 1.3.2 - ajax.php id Parameter SQL Injection
Published
2015-11-24
Title
Contact Form Maker <= 1.7.30 - Authenticated Blind SQL Injection
Published
2024-12-13
Title
WP Job Portal < 2.2.3 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()
Published
2025-03-13
Title
WPCOM Member < 1.7.7 - Unauthenticated Time-Based SQL Injection
Published
2023-12-21
Title
Simply Schedule Appointments < 1.6.6.1 - Authenticated(Administrator+) SQL Injection