CVE-2026-89216: vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
Published Oct 29, 2026
·Updated
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
Affected Software
1 affected component
WordPress vTables<0.3
Event History
Oct 29, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker does not need to authenticate. Any deployment using a vTables version before 0.3 is potentially exposed if the vulnerable parameter is reachable.
2
What could an attacker gain through exploitation?
The SQL injection can be used to extract data from the WordPress database.
3
What is the affected version range?
vTables versions before 0.3 are affected. The provided information does not identify a specific fixed release beyond that boundary.