CVE-2026-94298: BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and when does the injected SQL execute?
An authenticated user with the Contributor role can submit malicious data through the list_content parameter. The SQL is stored and executes later when the resulting content is published and viewed by an unauthenticated visitor.
Are public visitors required to be authenticated for the payload to run?
No. The vulnerable query is triggered when any unauthenticated visitor views the published content containing the stored payload.
Which versions are affected?
BuildKit WordPress plugin versions earlier than 1.0.29 are affected. The provided information does not identify a separate affected configuration or mitigation.