CVE-2026-89296
Received Received - Intake

SQL Injection in Pro Like Button WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: WPScan

Description
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-89296
EUVD
EUVD-2026-90514

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pro_like_button pro_like_button to 2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Pro Like Button WordPress plugin before version 2.0. The plugin fails to properly sanitize and escape the 'postid' parameter before using it in SQL queries, allowing attackers to inject malicious SQL commands.

Detection Guidance

To detect this vulnerability, check if the Pro Like Button WordPress plugin version is below 2.0. You can use WordPress commands like 'wp plugin list' or inspect the plugin files for version details. Additionally, monitor for unusual SQL query patterns or unauthorized database access.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands on your WordPress database, potentially stealing sensitive data, modifying or deleting records, or taking control of your website. Since it requires no authentication, any unauthenticated user could potentially attack your site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations may face fines or penalties if this vulnerability results in a data breach.

Mitigation Strategies

Immediately update the Pro Like Button plugin to version 2.0 or later. If updating is not possible, consider disabling or removing the plugin until a patch is applied. Ensure your WordPress installation and all plugins are regularly updated to prevent similar issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart