CVE-2026-12983: Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

Q: Who can exploit this issue?

Any unauthenticated visitor can exploit the affected handler. No authorization check is performed before the SQL query or table truncation operation.

Q: What versions are affected?

The issue affects the Dinatur WordPress plugin through version 1.18.

Q: What can an attacker do beyond SQL injection?

The same unauthenticated handler can truncate the plugin's database table, allowing an attacker to wipe Dinatur plugin data.

Published Aug 19, 2026

Updated

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.

Affected Software

1 affected component

Dinatur Dinatur WordPress plugin<=1.18

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor can exploit the affected handler. No authorization check is performed before the SQL query or table truncation operation.

What versions are affected?

The issue affects the Dinatur WordPress plugin through version 1.18.

What can an attacker do beyond SQL injection?

The same unauthenticated handler can truncate the plugin's database table, allowing an attacker to wipe Dinatur plugin data.