---
id: CVE-2026-76005
title: >-
  WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via
  'sort_order' Shortcode Attribute
summary: >-
  The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL
  Injection via 'sort_order' Shortcode Attribute in all versions up to, and
  including, 2.5.5 due to insufficient escaping on the user supplied parameter
  and lack…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: chuck1982
product: WP Inventory Manager
affected:
  - wp_inventory_manager <= 2.5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T01:28:59.710419Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T01:41:50.537Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-76005'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/f0682bf7-0b5a-402f-9ae0-34e2f0f65bcf?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.category.class.php#L78
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.category.class.php#L78
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L107
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L38
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L107
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L38
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3712512%40wp-inventory-manager&new=3712512%40wp-inventory-manager
tags:
  - cve.org
epss: 0.00281
epssPercentile: 0.20656
ingestedAt: '2026-10-28T07:06:27.101Z'
---

## Overview

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.

## Affected

- `wp_inventory_manager <= 2.5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.