PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89299 WP Verify API CVE debrief

CVE-2026-89299 is a SQL injection vulnerability in the WP Verify API WordPress plugin through 1.0.0. The CVE record was published on 2026-10-11T07:17:28.770Z and has not been modified since then. This vulnerability allows unauthenticated users to perform SQL injection attacks. Defenders responsible for WordPress installations using the WP Verify API plugin should assess exposure and prioritize verification and mitigation. The CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine the affected versions and potential impact. The vulnerability has a CVSS score of null and a CVSS severity of null.

Vendor
WP Verify API
Product
WP Verify API WordPress plugin
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for WordPress installations using the WP Verify API plugin should assess exposure and prioritize verification and mitigation.

Why it matters

CVE-2026-89299 is a SQL injection vulnerability in the WP Verify API WordPress plugin. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and apply patches or mitigations as available. The CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine the affected versions and potential impact.

  • Potential SQL injection attacks against unauthenticated users
  • Verification of plugin presence and version in WordPress installations
  • Monitoring for suspicious SQL queries

Technical summary

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. This vulnerability can be exploited by unauthenticated users, and defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and apply patches or mitigations as available. The affected product is the WP Verify API WordPress plugin, and the vulnerability has not been modified since its publication on 2026-10-11T07:17:28.770Z.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and apply patches or mitigations as available.

Recommended defensive actions

  • Verify the presence of the WP Verify API WordPress plugin in your installation
  • Check for and apply patches or updates for the plugin
  • Monitor for potential SQL injection attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89299 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89299

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89299 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89299

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.