CVE-2026-89234: WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

Q: Who can exploit this issue?

The vulnerable parameter is reachable by unauthenticated attackers, so no WordPress account or prior login is required.

Q: What could an attacker obtain through exploitation?

An attacker can append additional SQL queries and extract sensitive information from the WordPress database.

Q: Which installations are affected?

WP-Partner versions through 1.2.1 are affected. The provided information does not state whether any particular WordPress configuration or deployment condition is required.

Published Oct 11, 2026

Updated

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Affected Software

1 affected component

WP-Partner<=1.2.1

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

The vulnerable parameter is reachable by unauthenticated attackers, so no WordPress account or prior login is required.

What could an attacker obtain through exploitation?

An attacker can append additional SQL queries and extract sensitive information from the WordPress database.

Which installations are affected?

WP-Partner versions through 1.2.1 are affected. The provided information does not state whether any particular WordPress configuration or deployment condition is required.

CVE-2026-89234: WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through exploitation?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker obtain through exploitation?

Which installations are affected?