All vulnerabilities
CVE-2026-76005

WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

chuck1982 WP Inventory Manager
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationExploitation reported1 outlet report it, first 28 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 28 Oct 2026, 06:45 UTCPublishedCVE List
  2. 28 Oct 2026, 07:22 UTCFirst reported exploitedTelegram: CVE Notify
  3. NowNot on CISA's known exploited list yet

Reports 1

One outlet reports exploitation. Reports are not confirmation; each links to its source.

Description

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.

Text from CVE List

Affected versions 1

  • WP Inventory Manageraffected: all versions through 2.5.5CVE List

References 8