SQL Injection Vulnerability in WP-Partner Plugin by WordPress
CVE-2026-89234
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-89234?
The WP-Partner plugin for WordPress versions up to 1.2.1 has a vulnerability that allows unauthenticated attackers to inject additional SQL queries. This flaw occurs due to improper sanitization and escaping of a parameter before executing it in a SQL query. As a result, an attacker could extract sensitive data from the database, posing a significant risk to WordPress sites utilizing this plugin.
Affected Version(s)
WP-Partner 0 <= 1.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.