8.6
Élevée
CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on…
Description
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Fast Courier 5.0 | 5.0.0 → < 5.2.4 | 5.2.4 |