CVE-2026-16061 PUBLISHED

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

Assigner: WPScan
Reserved: 17.07.2026 Published: 29.08.2026 Updated: 29.08.2026

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Rest Routes
Versions Default: unknown
  • affected from 0 to 5.5.5 (incl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE