WordPress Plugin Vulnerabilities
Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
Description
The plugin does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
Proof of Concept
Affects Plugins
Fixed in 3.6.0 References
CVE
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Real_King_Engine (ISAL FRAMEWORK)
Submitter
Real_King_Engine (ISAL FRAMEWORK)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-08-07 (about 3 days ago)
Added
2026-08-07 (about 2 days ago)
Last Updated
2026-08-07 (about 2 days ago)
WPScan 