SQL Injection Vulnerability in Vitepos WordPress Plugin
CVE-2026-14238
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14238?
The Vitepos WordPress plugin, prior to version 3.6.0, suffers from a significant security flaw due to inadequate sanitization and parameterization of an identifier sourced from a REST request body. This shortcoming can be exploited by users with administrator-level access, enabling them to execute SQL injection attacks through one of the plugin's report endpoints. As a result, unauthorized database queries can be performed, potentially compromising the integrity and security of the application.
Affected Version(s)
vitepos 0 < 3.6.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.