CVE-2026-93000: SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
Published Sep 28, 2026
·Updated
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
Affected Software
1 affected component
SPS-Suite SPS-Suite WordPress plugin<=1.4.0
Event History
Sep 28, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are exposed?
WordPress sites using SPS-Suite version 1.4.0 or earlier are affected when the plugin's static-page search feature is enabled.
2
Does exploitation require an authenticated WordPress account?
No. The issue can be exploited by unauthenticated attackers when the affected search feature is enabled.