Security Alert Summary
The Recordbrowser WordPress plugin through version 1.1.7 contains an SQL injection vulnerability. A parameter is not sanitised and escaped before being used in a SQL query, which allows unauthenticated attackers to append additional SQL and extract data from the site database.
CVE Details
- CVE ID: CVE-2026-89232
- Affected component: Recordbrowser WordPress plugin
- Affected versions: versions up to and including 1.1.7 (<= 1.1.7)
- Published: October 11, 2026 at 7:17:28 AM (timestamp from JSON)
- Last modified: October 11, 2026 at 12:17:26 PM (timestamp from JSON)
- CVSS v3.1: Base score 8.6, severity HIGH, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Authentication / privileges / user interaction: No authentication required. Privileges required: None. User interaction: None. (Data from CVSS v3.1 vector)
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness: CWE-89 (SQL Injection)
Technical Details
The plugin fails to sanitise and escape a parameter before incorporating it into a SQL query. Because the input is used directly in the query, an unauthenticated attacker can supply crafted input that appends additional SQL statements. This is an SQL injection vulnerability that can be exploited remotely without credentials.
The description provided does not name specific functions or REST endpoints. Based only on the supplied information, the issue stems from missing input validation and escaping prior to query construction, allowing arbitrary SQL to be injected and executed against the database.
Impact is limited to the exposure of data retrievable via SQL queries. The CVSS data indicates confidentiality impact is High, while integrity and availability are not impacted according to the provided metrics.
How This Could Impact Your Website
On a multi-user WordPress site, an attacker exploiting this vulnerability could extract sensitive data from the database. In a typical scenario, a site owner maintains the site, internal staff or editors manage content, and external contractors or contributors may have limited access. Even though the vulnerability requires no authentication, extracted data could include user records, emails, or other stored information that attackers can use outside the site.
Practical consequences include exposure of internal user email addresses and increased risk of targeted phishing or social engineering against staff or contractors. The vulnerability does not, based on the supplied information, indicate direct site takeover, but the disclosed data could materially aid further attacks.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that are not actively used.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual database queries or other anomalous behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
