CVE-2026-76005

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.

• CWE-89

• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.category.class.php#L78
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L107
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L38
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.category.class.php#L78
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L107
• https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L38
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3712512%40wp-inventory-manager&new=3712512%40wp-inventory-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f0682bf7-0b5a-402f-9ae0-34e2f0f65bcf?source=cve

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7600A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. Thi…6.3
• CVE-2026-76000ColdFusion is affected by an Uncontrolled Resource Consumpti…6.5
• CVE-2026-76001ColdFusion is affected by a Server-Side Request Forgery (SSR…7.1
• CVE-2026-76002ColdFusion is affected by a reflected Cross-Site Scripting (…6.1
• CVE-2026-76003A weakness has been identified in UTT HiPER 1200GW up to 2.5…9.9
• CVE-2026-76004A security vulnerability has been detected in UTT HiPER 1250…9.9
• CVE-2026-76006The Photo Gallery by Ays – Responsive Image Gallery plugin f…4.9
• CVE-2026-76008A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affec…10
• CVE-2026-76009The Next-Cart Store to WooCommerce Migration plugin for Word…8.1
• CVE-2026-7601A vulnerability has been found in Open5GS up to 2.7.6. Affec…5.3
• CVE-2026-76012The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…7.5
• CVE-2026-76014A vulnerability has been found in BusyBox up to 1.30.1. This…3.3