CVE-2026-89288
Deferred Deferred - Pending Action

SQL Injection in Fast Courier WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-89288
EUVD
EUVD-2026-100860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Fast Courier 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Fast Courier WordPress plugin before version 5.2.4 has an unauthenticated SQL injection vulnerability. It fails to properly sanitize and escape the 'wp_order_id' parameter in an unauthenticated REST route, allowing attackers to execute arbitrary SQL queries without authentication and access sensitive database information.

Detection Guidance

Check if the Fast Courier WordPress plugin version is between 5.0.0 and 5.2.3. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Monitor network traffic for suspicious SQL queries targeting unauthenticated REST routes.

Impact Analysis

This vulnerability allows unauthenticated attackers to read arbitrary data from the database, potentially exposing sensitive information such as user credentials, personal data, or other confidential details stored in the WordPress database.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Fast Courier plugin to version 5.2.4 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied. Review database access logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart