Skip to content
Sign in
8.6 High

CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on…

Description

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Affected products and versions

Product Affected versions Fixed in
Fast Courier 5.0 5.0.0 → < 5.2.4 5.2.4

Other CVEs of Fast Courier

The 2 CVEs of Fast Courier →
CVE-2026-89289 The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order… 5.3 Medium
Track this CVE