Site Setup Wizard WordPress plugin: Unauthenticated SQL injection
Summary
The Site Setup Wizard WordPress plugin up to and including version 1.5.8 does not properly sanitise a parameter used in an SQL statement. An unauthenticated attacker can send crafted requests to the ssw_check_admin_email_exists endpoint and read data from the database. No login is required, so any internet-exposed WordPress site with the plugin installed is at risk.
Affected
- Site Setup Wizard WordPress plugin, versions 0 to 1.5.8
- Vendor and author of the plugin are not confirmed
Fixed in
Unknown. WPScan lists no known fix.
Workaround
- Deactivate and remove the plugin if it is not needed
- If it must stay, block or restrict access to the ssw_check_admin_email_exists endpoint at the web application firewall or reverse proxy
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable yes
- No public proof of concept found at time of research
Our recommendation
- Inventory WordPress sites for the Site Setup Wizard plugin
- Remove the plugin where it is not needed
- Where it is needed, restrict the vulnerable endpoint, review web server and WordPress logs for requests to it, and check the database for unexpected changes
- Monitor the WPScan entry and the CVE record for a fixed version and do not assume later versions are safe until the vendor confirms
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-89195 app.opencve.io
- Vulners NVD record CVE-2026-89195 vulners.com
- Vulners VulnCheck record CVE-2026-89195 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:00.
Original description (NVD)
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.