PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89287 ASPL CVE debrief

The ASPL Product Quotation WordPress plugin through 1.1.0 is vulnerable to SQL injection due to a lack of sanitization and escaping of a parameter used in SQL statements. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database. The vulnerability requires verification of the plugin version and presence in WordPress installations, and potential updates to prevent exploitation. Defenders should assess their exposure and prioritize verification and potential updates. The CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine the affected versions and potential.

Vendor
ASPL
Product
Product Quotation WordPress plugin
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for WordPress installations using the ASPL Product Quotation plugin should assess their exposure and prioritize verification and potential updates.

Why it matters

Defenders should care about CVE-2026-89287 because it represents a SQL injection vulnerability in the ASPL Product Quotation WordPress plugin, allowing unauthenticated attackers to read arbitrary data from the database. The vulnerability requires verification of the plugin version and presence in WordPress installations, and potential updates to prevent exploitation.

  • Potential data exposure through SQL injection
  • Required verification of plugin version and vulnerability presence
  • Possible impact on database integrity and confidentiality

Technical summary

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database. The vulnerability is caused by a lack of input validation and sanitization, which enables attackers to inject malicious SQL code. This could lead to unauthorized access to sensitive data and potentially allow attackers to modify database contents.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating the plugin to a fixed version if available.

Recommended defensive actions

  • Verify the presence of the ASPL Product Quotation WordPress plugin in your WordPress installation
  • Check if the plugin version is 1.1.0 or earlier
  • Update the plugin to a fixed version if available
  • Monitor database activity for suspicious SQL queries

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89287 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89287

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89287 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89287

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.