CVE-2026-89237: Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters
Published Sep 26, 2026
·Updated
The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.
Affected Software
1 affected component
Bluff Post Bluff Post<=1.1.1
Event History
Sep 26, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker does not need to authenticate. Any reachable installation of the affected plugin may be exposed to attempts to inject SQL through the table_name and column_name parameters.
2
What could an attacker obtain?
The issue allows additional SQL to be appended to a database query, which can be used to extract sensitive information from the WordPress database.
3
Which plugin versions are affected?
Bluff Post versions through 1.1.1 are affected.