SQL Injection Vulnerability in Testimonials by BestWebSoft WordPress Plugin
CVE-2026-89235

6.8MEDIUM

Key Information:

Vendor

WordPress
Status
Testimonials By Bestwebsoft
Vendor
CVE Published:
9 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-89235?

The Testimonials by BestWebSoft plugin for WordPress, up to version 1.0.8, has a vulnerability where it fails to properly sanitize and escape a user-supplied parameter in a SQL query. This oversight allows unauthenticated attackers to manipulate the SQL query by appending additional SQL commands, potentially compromising the database and exposing sensitive information.

Affected Version(s)

Testimonials by BestWebSoft 1.0.5 <= 1.0.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-89235 - Proof of Concept

References

https://wpscan.com/vulnerability/00801815-efc8-41f7-9984-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.