CVE-2026-17607: WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::getall() function — parsecustomwhere() only performs htmlentitydecode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->getresults(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-inventory-managerto a version that resolves this vulnerability.Fixed in 2.5.1 - Configuration
Update the plugin so the 'where' shortcode attribute is parsed and mapped using a whitelist (allowed field names/operators/order) and the final SQL is built using $wpdb->prepare() (rather than concatenating the user-supplied string into a raw SELECT executed via $wpdb->get_results()).
WP Inventory Manager (WordPress plugin) [wpinventory] shortcode attribute 'where' handling = Use $wpdb->prepare() and/or a strict whitelist for allowed fields/operators; do not execute raw concatenated SQL from parse_custom_where()
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attack is network-accessible and does not require user interaction.
What access or feature is required for exploitation?
The attacker must be able to submit the where attribute in the [wpinventory] shortcode. The vulnerable query path processes that attribute in WPIMItem::get_all().
What is the likely impact?
An attacker can append SQL to an existing query and extract sensitive information from the WordPress database. The provided severity vector indicates confidentiality impact only; integrity and availability impacts are not indicated.
How can I identify affected installations?
Check whether the WordPress site has the WP Inventory Manager plugin installed and whether its version is 2.5.1 or earlier. Also review whether Contributor or higher users can create or edit content containing the [wpinventory] shortcode with a where attribute.
What can be done if updating is not immediately possible?
Restrict Contributor-level and higher access to trusted users, and prevent untrusted users from publishing or modifying content that can include the [wpinventory] shortcode and its where attribute. Review existing content for uses of that shortcode attribute.