CVE-2026-89288
8.6HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Unauthenticated remote attackers can extract arbitrary database contents via SQL injection. All they need is network access to the exposed REST API route.
Root cause
An unauthenticated REST API endpoint incorporates an unsanitized and unescaped input parameter directly into a SQL query.
Affected systems
Fast Courier WordPress plugin before 5.2.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade the Fast Courier plugin to version 5.2.4 or later. If updating immediately is not possible, deactivate the Fast Courier plugin or block access to its REST routes at the reverse proxy/WAF.
$ wp plugin update fast-courierAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.