SQL Injection Vulnerability in WP Inventory Manager Plugin for WordPress

CVE-2026-17607

What is CVE-2026-17607?

The WP Inventory Manager plugin for WordPress allows authenticated users with Contributor-level access and above to exploit a SQL Injection vulnerability. This occurs through the 'where' shortcode attribute in the [wpinventory] shortcode. The issue arises from insufficient escaping of user-supplied parameters in the existing SQL query management. Specifically, the parse_custom_where() function fails to implement robust preparation methods, thereby permitting attackers to inject and execute arbitrary SQL statements. This can lead to unauthorized access and extraction of sensitive information from the database, posing a significant security risk.

References