ASPL Product Quotation: Unauthenticated SQL injection via quote_id parameter
Summary
The ASPL Product Quotation WordPress plugin up to and including version 1.1.0 does not sanitize the quote_id parameter before using it in SQL statements. Unauthenticated attackers can perform SQL injection and read arbitrary data from the database, which in WordPress may include user accounts and password hashes. No vendor fix is known, and no evidence of exploitation in the wild was found.
Affected
- ASPL Product Quotation WordPress plugin, versions 0 to 1.1.0 (inclusive)
- Vulnerable parameter: quote_id
- CWE-89 (SQL Injection), CVSS 3.1 base score 8.6 (NVD and WPScan)
Fixed in
Unknown. WPScan lists 'No known fix'. No vendor advisory was found.
Workaround
- Deactivate and remove the plugin if it is not business-critical (most reliable step)
- If it must remain, use a web application firewall or virtual patch with SQL injection rules
- Restrict the database user's privileges where possible
- Review web server logs for unusual requests to the plugin
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV
- CISA SSVC: exploitation 'none', automatable 'yes', technical impact 'partial'
- Public proof of concept: unclear, not confirmed
Our recommendation
- Check whether the plugin is installed on any site you manage, including sites you may not know about
- Deactivate and remove the plugin if no fixed version is available
- If the plugin is needed, apply a WAF or virtual patch and monitor logs for SQL injection attempts
- Review database accounts and consider rotating credentials if exposure is suspected
- Re-check the NVD entry and the vendor for a fixed version
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB CVE-2026-89287 vuldb.com
- OpenCVE CVE-2026-89287 app.opencve.io
- Vulners NVD entry vulners.com
- Vulners VulnCheck enrichment vulners.com
- TheHackerWire CVE-2026-89287 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:56.
Original description (NVD)
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.