WordPress Plugin Vulnerabilities

WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

Description

The plugin does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Proof of Concept

Affects Plugins

Plugin icon
wp-partner
No known fix

References

CVE
CVE-2026-89234

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Raúl Conesa
Submitter
Raúl Conesa
Verified
Yes
WPVDB ID
aad77794-bfe5-4ea6-a5b2-82c259140cae

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2026-06-30
Title
BookingPress Appointment Booking Pro < 5.7.2 - Unauthenticated SQL Injection via 'store_service_date' Parameter
Published
2021-06-29
Title
Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL Injections
Published
2024-12-14
Title
WP Simple Pay Lite Manager <= 1.4 - Authenticated (Administrator+) SQL Injection
Published
2025-04-03
Title
Product Filter by WBW < 2.8.0 - Unauthenticated SQL Injection via filtersDataBackend Parameter
Published
2021-08-22
Title
WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection