Security Alert Summary
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled. This allows unauthenticated attackers to perform SQL injection attacks that can expose confidential data from the site database.
CVE Details
- CVE ID:
CVE-2026-93000 - Affected component: SPS-Suite WordPress plugin (static-page search feature)
- Affected versions: Through 1.4.0 (<= 1.4.0)
- Published: September 28, 2026 at 7:17:21 AM
- Last modified: September 28, 2026 at 4:38:58 PM
- CVSS v3.1: Base score 6.8 (Medium); Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- Authentication / Privileges / User interaction: No authentication required; Privileges required: None; User interaction: None; Attack complexity: High; Attack vector: Network; Scope: Changed
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The plugin fails to sanitise the search query parameter before including it in a SQL query when the static-page search feature is enabled. Because input is used directly in a database query without proper validation or parameterisation, an unauthenticated attacker can inject SQL payloads into the search input and cause the application to execute unintended database commands.
The vulnerability is specific to the static-page search functionality and the handling of the search query. The CVE description does not name specific functions or REST endpoints, so only the described feature and query handling are identified as the root cause.
Impact is limited to actions achievable via SQL injection as described: an attacker may be able to read or extract sensitive data from the database. The provided CVSS metrics indicate a confidentiality impact while not indicating changes to integrity or availability.
How This Could Impact Your Website
Consider a small organization running SPS-Suite on a WordPress site with multiple users: the site owner, internal staff who manage content, and external contributors or contractors who perform occasional edits. An attacker exploiting this SQL injection could extract data from the database, such as internal user email addresses or other stored records. That exposed information could be used to craft targeted phishing campaigns or social engineering attempts against staff or contractors.
Because the vulnerability is exploitable without authentication, even public-facing search inputs can be abused. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual database queries or unexpected search input patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
