CVE-2026-16949 PUBLISHED

Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup

Assigner: WPScan
Reserved: 24.07.2026 Published: 10.08.2026 Updated: 10.08.2026

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Term Pages
Versions Default: unaffected
  • affected from 0 to 2.0.0 (excl.)

Credits

  • João Ramos Maciel finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE