CVE-2026-89232: RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
Published Oct 11, 2026
·Updated
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Affected Software
1 affected component
RecordBrowser<=1.1.7
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated attackers can exploit it; no WordPress account or prior authentication is required.
2
What access does an attacker need to trigger the vulnerability?
An attacker needs to be able to send a request containing the recordid parameter to an affected RecordBrowser installation. The vulnerable parameter is used in a SQL query without sanitisation and escaping.
3
What could an attacker obtain through exploitation?
An attacker may append additional SQL queries and extract sensitive information from the WordPress database.
4
Which versions are affected?
RecordBrowser versions through 1.1.7 are affected according to the available information.