WP-Partner WordPress plugin: Unauthenticated SQL injection via id parameter
Summary
The WP-Partner WordPress plugin through version 1.2.1 does not sanitise and escape a parameter before using it in a SQL query. An unauthenticated remote attacker can append additional SQL queries and extract sensitive information from the WordPress database, such as user data or credentials. Any internet-facing site running the plugin is reachable without an account.
Affected
- WP-Partner WordPress plugin up to and including 1.2.1
- Vendor: Unknown.
Fixed in
- Unknown. No fixed version is known; WPScan lists the status as "No known fix".
Workaround
- Unknown from vendor sources. A WAF virtual patch may be available from third parties; this could not be confirmed.
- Restrict access to the affected endpoint at the web server or WAF.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV.
- Public proof of concept: unclear; VulDB states no exploit is available.
Our recommendation
- Check whether the WP-Partner plugin is installed on any WordPress site, including old or forgotten ones.
- If it is not needed, deactivate and delete it.
- If it must stay, restrict access to the affected endpoint at the web server or WAF and keep WordPress core and other plugins up to date.
- Review database and web server logs for unusual query errors or responses, and rotate database credentials if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- NVD record (via vulners) vulners.com
- VulDB CVE entry vuldb.com
- VulDB exploit status vuldb.com
- Vulners VulnCheck/Patchstack record vulners.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:54.
Original description (NVD)
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.