CVE-2026-14189
Description
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Unknown | WPBot | — | 0 < 8.5.2 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| — | cna | CWE-89 SQL Injection |