CVE-2026-89213: Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
Published Oct 11, 2026
·Updated
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
Affected Software
1 affected component
Llavero.io Llavero.io WordPress plugin<=0.1.4
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated attackers can exploit it; no login is required. An affected site running the Llavero.io WordPress plugin through version 0.1.4 is exposed.
2
What can an attacker do with this vulnerability?
An attacker can use SQL injection to read data from the site's database. The issue is described as blind SQL injection, so data extraction may occur indirectly through application responses.
3
Which input is involved?
The vulnerable input is the cill_login parameter, which is not properly sanitised and escaped before being used in a SQL statement.