CVE-2026-16061: Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}
Published Aug 29, 2026
·Updated
The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Affected Software
1 affected component
WordPress Rest Routes<=5.5.5
Event History
Aug 29, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated attackers can exploit the affected public REST route; no login is required.
2
What input is vulnerable?
The table_name value in the custom-tables/tables/{table_name} REST-route path is used in a SQL query without sanitization and validation.
3
Which plugin versions are affected?
WordPress Rest Routes versions through 5.5.5 are affected.