CVE-2026-89216 PUBLISHED

vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter

Assigner: WPScan
Reserved: 11.09.2026 Published: 29.10.2026 Updated: 29.10.2026

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.

Product Status

Vendor Unknown
Product vTables
Versions Default: unaffected
  • affected from 0 to 0.3 (excl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente finder
  • and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE