CVE-2026-17607

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->get_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L211
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L269
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L748
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.shortcode.class.php#L72
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/wpinventory.core.php#L448
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3657730%40wp-inventory-manager&new=3657730%40wp-inventory-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1f439d60-0295-4ea8-b16d-9cdd0d866a8d?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1760A flaw was found in SoupServer. This HTTP request smuggling …5.3
• CVE-2026-17600Sonatype Nexus Repository 3 did not immediately terminate a …8.8
• CVE-2026-17601A user holding a permission to update privilege definitions …7.2
• CVE-2026-17603Nexus Repository 3 did not sufficiently restrict which Hikar…8.8
• CVE-2026-17604The Kirki – Freeform Page Builder, Website Builder & Customi…4.9
• CVE-2026-17605The Payment forms, Buy now buttons, and Invoicing System | G…6.6
• CVE-2026-17608The WP Compress – Instant Performance & Speed Optimization p…6.5
• CVE-2026-1761A flaw was found in libsoup. This stack-based buffer overflo…8.6
• CVE-2026-17610In SiSDK v2026.6.0 and earlier, high network traffic loads c…6
• CVE-2026-17612Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions …6.9
• CVE-2026-17613Penpot’s ::import-binfile RPC command lacks authorization on…7.5
• CVE-2026-17615A flaw was found in RESTEasy's SourceProvider. This vulnerab…7.5