CVE-2026-76005: WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventorycategories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker does not need to publish content; a draft post preview is sufficient.
What must an attacker do to trigger the vulnerability?
The attacker needs to embed the [wpinventory_categories] shortcode in a draft post and supply a crafted sort_order attribute. Viewing the draft through WordPress preview triggers the vulnerable query.
What is the potential impact?
The SQL injection is time-based and can be used to extract sensitive information from the WordPress database. The provided data indicates confidentiality impact but no integrity or availability impact.
Which installations are affected?
WP Inventory Manager versions up to and including 2.5.5 are affected. Exploitation requires that an attacker can create or modify content containing the affected shortcode and access its preview.