CVE-2026-89302: Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
Published Oct 11, 2026
·Updated
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Affected Software
1 affected component
Post Voting System<=1.0
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated users can exploit the SQL injection issue; no login or authenticated WordPress account is required.
2
Which plugin versions are affected?
Post Voting System versions through 1.0 are affected.
3
What input is involved in the vulnerable query?
The issue is associated with the plugin's id parameter, which is not properly sanitized and escaped before being used in a SQL query.