Post Voting System WordPress plugin: Unauthenticated SQL injection via 'id' parameter
Summary
The Post Voting System WordPress plugin through version 1.0 does not properly sanitize and escape a parameter before using it in an SQL query. An unauthenticated remote attacker can send crafted requests to inject SQL commands and read data from the WordPress database, such as user and content data or password hashes. No login is required, but the vulnerable endpoint must be reachable on the website.
Affected
- Post Voting System WordPress plugin, versions 1.0 and earlier
- Vendor: Unknown
Fixed in
- No known fix. Unknown whether a patched version exists.
Workaround
- Deactivate and remove the plugin if it is not essential.
- If the plugin must stay, deploy a web application firewall rule that blocks suspicious SQL payloads on the voting endpoint. This is a temporary measure only.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: exploitation none, automatable no.
- EPSS about 0.18%.
- A public proof of concept is unconfirmed; one may exist.
- No confirmed in-the-wild exploitation found.
Our recommendation
- Check whether the plugin is installed and active on your WordPress sites.
- Deactivate and remove it if it is not required.
- If it is required, apply a WAF virtual patch and restrict access to the affected endpoint.
- Check the plugin's WordPress.org page and changelog for a fixed release.
- Monitor web server and database logs for SQL error messages and unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- OpenCVE CVE-2026-89302 app.opencve.io
- VulDB CVE-2026-89302 vuldb.com
- VulnCheck/Vulners VULNRICHMENT CVE-2026-89302 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:57.
Original description (NVD)
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.