CVE-2026-89237
Received Received - Intake

Blind SQL Injection in Bluff Post WordPress Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: WPScan

Description
The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-89237
EUVD
EUVD-2026-87527

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bluff_post bluff_post to 1.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Bluff Post WordPress plugin through version 1.1.1 has an unauthenticated SQL injection vulnerability. It fails to properly sanitize and escape parameters like 'table_name' and 'column_name' before using them in SQL queries. This allows attackers to inject malicious SQL code, potentially accessing sensitive database information.

Detection Guidance

Check if the Bluff Post WordPress plugin version 1.1.1 or earlier is installed. Look for suspicious SQL query patterns in logs or network traffic that involve the 'table_name' or 'column_name' parameters.

Impact Analysis

This vulnerability allows unauthenticated attackers to extract sensitive data from the database, such as user credentials, personal information, or other confidential data. It could lead to data breaches, unauthorized access, or further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other data protection regulations by exposing personal or sensitive data. Organizations may face legal penalties, fines, or reputational damage due to unauthorized data access or breaches.

Mitigation Strategies

Immediately update the Bluff Post plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Monitor database queries for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart