CVE-2026-89288: Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
Published Oct 14, 2026
·Updated
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Affected Software
1 affected component
Fast Courier Fast Courier<5.2.4
Event History
Oct 14, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the affected WordPress site's REST route can exploit it; no login is required.
2
What versions are affected and what is the remediation?
Fast Courier versions before 5.2.4 are affected, including 5.0.0 through 5.2.3. Update the plugin to version 5.2.4 or later.
3
What data could an attacker access?
Successful SQL injection can allow an attacker to read arbitrary data from the WordPress database.