Read the docs
TI-2026-70485 Aliases CVE-2026-89299GHSA-mm7c-7mwq-mppr

WP Verify API Unauthenticated SQL Injection via verify Parameter

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape the verify parameter before using it in a SQL query (CWE-89), so unauthenticated users can perform SQL injection. The CVSS 3.1 base score is 8.6 (HIGH), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. A link to exploit material appears in the references. CISA has not added CVE-2026-89299 to KEV, and its SSVC data lists exploitation as none, automatable as yes, and technical impact as partial.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Verify APIup to 1.0.0—No fix listedCNA
  • WP Verify API VendorUnknown Affected up to 1.0.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for WP Verify API, and the vendor is unknown. Deactivate and remove the plugin from affected sites until a fixed release is available. Until then, block requests that carry SQL metacharacters in the verify parameter at a web application firewall.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-89299
  2. 2026-10-11 Alias added: GHSA-mm7c-7mwq-mppr

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences