CVE-2026-89296 PUBLISHED

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

Assigner: WPScan
Reserved: 11.09.2026 Published: 01.10.2026 Updated: 01.10.2026

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Pro Like Button
Versions Default: unaffected
  • affected from 0 to 2.0 (excl.)

Credits

  • Enrico Marcolini - Claudio Marchesini - Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE