SQL Injection Vulnerability in WP Inventory Manager Plugin for WordPress
CVE-2026-76005

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Inventory Manager
Vendor
CVE Published:
28 October 2026

What is CVE-2026-76005?

The WP Inventory Manager plugin for WordPress contains a time-based SQL Injection vulnerability via the 'sort_order' shortcode attribute. This vulnerability arises from insufficient escaping of user-supplied parameters and a lack of adequate preparation of SQL queries. Authenticated users with Contributor-level access or higher can exploit this flaw to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive database information. Notably, this can be done through a draft post's preview without the need for the post to be published, increasing the risk of data exposure.

Affected Version(s)

WP Inventory Manager 0 <= 2.5.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-inventory-m...
https://plugins.trac.wordpress.org/browser/wp-inventory-m...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.