Fast Courier CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Fast Courier CVE published 2026-10-14

CVE-2026-89288

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database. This vulnerability requires immediate attention as it could lead to significant data exposure and potential exploitation by attackers. Defenders should asse [truncated]