{"id":"CVE-2026-89216","revision":"47febe63ac2a4b22902cc7126563ea49","records":[{"revision":"47febe63ac2a4b22902cc7126563ea49","observedAt":"2026-10-29T12:12:12.337+00:00","statement":{"source":"cve-program","id":"CVE-2026-89216","aliases":[],"title":"vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter","description":"The vTables  WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.","state":0,"publishedAt":"2026-10-29T06:00:23.322+00:00","modifiedAt":"2026-10-29T10:56:08.266+00:00","affected":[{"ecosystem":"Vendor product","name":"vTables","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"vTables\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.3\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/f47fbd01-cca8-46fd-aff3-b9c551b08bac/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89216","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89216","identifiers":["CVE-2026-89216"]},"retained":false,"historicalAffected":[]}],"coverage":[]}