SQL Injection Vulnerabilities in Loja Automática WordPress Plugin
CVE-2026-89297

Currently unrated

Key Information:

Vendor

WordPress
Status
Loja Automática
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-89297?

The Loja Automática plugin for WordPress, up to version 1.0.0, is susceptible to SQL injection attacks due to inadequate sanitization and escaping of input parameters before their use in SQL queries. This vulnerability permits unauthorized users to manipulate database queries, potentially leading to unauthorized access to sensitive data and compromising the application's integrity.

Affected Version(s)

Loja Automática 0 <= 1.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-89297 - Proof of Concept

References

https://wpscan.com/vulnerability/590abff1-6ffd-48ce-a722-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.