CVE-2026-89213
Received Received - Intake

SQL Injection in Llavero.io WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-89213
EUVD
EUVD-2026-96781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Llavero.io 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the Llavero.io WordPress plugin version 0.1.4 and earlier. It occurs because the plugin does not properly sanitize and escape user input in the 'cill_login' parameter before using it in SQL queries. This allows unauthenticated attackers to inject malicious SQL commands and read sensitive data from the database.

Detection Guidance

To detect this vulnerability, check if the Llavero.io WordPress plugin version 0.1.4 or earlier is installed. Look for unauthenticated blind SQL injection attempts via the 'cill_login' parameter in server logs or network traffic.

Impact Analysis

This vulnerability allows attackers to read sensitive data from your WordPress database without authentication. They could access user credentials, personal information, or other confidential data stored in the database. Since no authentication is required, any unpatched version of the plugin is at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if sensitive data is exposed.

Mitigation Strategies

Immediately update the Llavero.io WordPress plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Monitor for suspicious SQL queries or unauthorized database access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart