CVE-2026-84068 PUBLISHED

Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

Assigner: WPScan
Reserved: 01.09.2026 Published: 09.09.2026 Updated: 09.09.2026

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

Product Status

Vendor Unknown
Product Quentn WP
Versions Default: unaffected
  • affected from 1.2.13 to 1.2.15 (excl.)

Credits

  • Yaswanth Reddy Sunkara finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE