CVE-2026-89236: SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters

Q: Who can exploit this issue?

Unauthenticated attackers can exploit it remotely; no login is required. Sites running SaveTo Wishlist Lite versions earlier than 1.1.5 are affected.

Q: Which inputs are involved in the vulnerable query?

The vulnerable ORDER BY clause uses the sort_column and sort_order parameters without sanitising or escaping them. An attacker can use these parameters to append SQL queries and extract sensitive database information.

Published Oct 3, 2026

Updated

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Affected Software

1 affected component

SaveTo SaveTo Wishlist Lite<1.1.5

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit it remotely; no login is required. Sites running SaveTo Wishlist Lite versions earlier than 1.1.5 are affected.

Which inputs are involved in the vulnerable query?

The vulnerable ORDER BY clause uses the sort_column and sort_order parameters without sanitising or escaping them. An attacker can use these parameters to append SQL queries and extract sensitive database information.

CVE-2026-89236: SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which inputs are involved in the vulnerable query?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which inputs are involved in the vulnerable query?