PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89302 Post Voting System CVE debrief

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. This vulnerability can lead to potential data breaches or unauthorized access. Defenders responsible for WordPress installations, particularly those using the Post Voting System plugin, should assess their exposure and prioritize verification or remediation. The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan.

Vendor
Post Voting System
Product
Post Voting System WordPress plugin
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for WordPress installations, particularly those using the Post Voting System plugin, should assess their exposure and prioritize verification or remediation.

Why it matters

Defenders should care about CVE-2026-89302 because it allows unauthenticated SQL injection attacks, potentially leading to data breaches or unauthorized access. WordPress administrators and security teams should verify the presence of the vulnerable plugin and prioritize remediation or monitoring.

  • Potential SQL injection attacks against unauthenticated users
  • Possible data tampering or unauthorized access to sensitive information

Technical summary

The Post Voting System WordPress plugin through 1.0 is vulnerable to SQL injection attacks due to improper sanitization and escaping of a parameter used in a SQL query. This vulnerability allows unauthenticated users to perform SQL injection attacks, potentially leading to data breaches or unauthorized access. WordPress administrators and security teams should verify the presence of the vulnerable plugin and prioritize remediation or monitoring.

Defensive priority

Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure it is updated or removed.

Recommended defensive actions

  • Verify the presence of the Post Voting System WordPress plugin in your WordPress installations
  • Check if the plugin is updated to the latest version or consider removing it
  • Monitor for potential SQL injection attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89302 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89302

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89302 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89302

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.