Description
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
Published: 2026-08-10
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from an unsanitized identifier field that is taken directly from a REST request body and used in a database query in the product‑details‑report endpoint. This lack of sanitization or parameterization allows administrator‑level users to inject arbitrary SQL statements, potentially compromising the confidentiality, integrity, and availability of the database data.

Affected Systems

WordPress sites using the Vitepos plugin, versions earlier than 3.6.0. No specific patch version list is provided beyond the 3.6.0 threshold.

Risk and Exploitability

The attack vector is a REST API call that requires administrator privileges. The CVSS score is 4.1 and the EPSS score is less than 1%, indicating a moderate severity but a very low likelihood of exploitation. The vulnerability is not listed in the KEV catalog. Based on the description, SQL injection can allow attackers to alter or retrieve data, which may compromise confidentiality and integrity of the database.

Generated by OpenCVE AI on August 13, 2026 at 08:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Vitepos plugin to version 3.6.0 or later.
  • Limit access to the REST API endpoint by IP filtering or additional authentication so that only trusted clients can invoke it.
  • Review database logs for unusual queries and monitor for signs of exploitation.

Generated by OpenCVE AI on August 13, 2026 at 08:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-89

Mon, 10 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Vitepos
Vitepos vitepos
Wordpress
Wordpress wordpress
Vendors & Products Vitepos
Vitepos vitepos
Wordpress
Wordpress wordpress

Mon, 10 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
Title Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
References

Subscriptions

Vitepos Vitepos
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-11T14:56:20.081Z

Reserved: 2026-06-30T13:05:42.022Z

Link: CVE-2026-14238

cve-icon Vulnrichment

Updated: 2026-08-11T14:56:10.128Z

cve-icon NVD

Status : Deferred

Published: 2026-08-10T07:16:47.053

Modified: 2026-08-26T16:31:16.753

Link: CVE-2026-14238

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:00:11Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')