SaveTo Wishlist Lite: Unauthenticated SQL injection via sort parameters
Summary
The SaveTo Wishlist Lite WordPress plugin before version 1.1.5 does not sanitise or escape the sort_column and sort_order parameters before using them in an ORDER BY clause. An unauthenticated attacker can append SQL queries to these parameters and read sensitive data from the WordPress database, such as customer records, order data or admin password hashes. No user interaction is required, but the attack depends on the vulnerable plugin being installed and active.
Affected
- SaveTo Wishlist Lite WordPress plugin versions before 1.1.5
- VulDB lists the affected range as up to 1.1.4; the CVE record and WPScan cover all versions before 1.1.5
Fixed in
- Version 1.1.5 (according to WPScan and the CVE record)
- No vendor advisory found; confirm the installed version in the WordPress admin or the plugin changelog
Workaround
- No vendor workaround found.
- VulDB suggests web application firewall rules for sorting-related parameters; a WAF rule is a temporary measure, not a fix.
- Deactivate the plugin until version 1.1.5 or later is installed.
Exploitation
- Public proof of concept: unknown.
- Exploited in the wild: no evidence found; not listed in CISA KEV according to third-party trackers (verify directly).
- EPSS: about 0.17% in one tracker, which is low.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify all WordPress sites running SaveTo Wishlist Lite, including inactive installations.
- Update the plugin to version 1.1.5 or later; if this is not possible, deactivate it.
- Review web server and WooCommerce logs for unusual values in sort_column and sort_order.
- If exploitation is suspected, rotate WordPress admin and database credentials and review admin accounts.
- Recheck the NVD entry and the CISA KEV catalogue in a few days, as NVD analysis is pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- VulDB CVE-2026-89236 vuldb.com
- Rapid7 via Vulners vulners.com
- CVE threatint record cve.threatint.com
- WordPress.org plugin page wordpress.org
- Strix CVE-2026-89236 www.strix.ai
- GitHub CVE tracker issue 1159 github.com
- Positive Technologies PT-2026-104529 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:22.
Original description (NVD)
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.