{"id":"CVE-2026-89216","title":"vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter","summary":"The vTables  WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-89"],"product":"vTables","affected":["vTables < 0.3"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T10:52:02.325920Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:08.266Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89216","references":[{"url":"https://wpscan.com/vulnerability/f47fbd01-cca8-46fd-aff3-b9c551b08bac/"}],"tags":["cve.org"],"epss":0.00274,"epssPercentile":0.19916,"ingestedAt":"2026-11-01T17:57:46.224Z","slug":"CVE-2026-89216","body":"## Overview\n\nThe vTables  WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.\n\n## Affected\n\n- `vTables < 0.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}