{"id":"CVE-2026-17607","aliases":["EUVD-2026-82749","GHSA-q2g2-xwwx-rp3m"],"status":"published","title":"WP Inventory Manager \u003c= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute","description":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb-\u003eprepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb-\u003eget_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00462,"percentile":0.40315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-09-18T07:39:59Z","modified":"2026-09-18T13:23:37Z","products":[{"vendor":"chuck1982","product":"wp inventory manager"},{"vendor":"wp inventory","product":"wp inventory manager"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f439d60-0295-4ea8-b16d-9cdd0d866a8d?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L269"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L748"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.item.class.php#L211"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/includes/wpinventory.shortcode.class.php#L72"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.4.1/wpinventory.core.php#L448"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3657730%40wp-inventory-manager\u0026new=3657730%40wp-inventory-manager"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17607"},{"url":"https://github.com/advisories/GHSA-q2g2-xwwx-rp3m"}],"sources":{"cve":[{"id":"CVE-2026-17607","title":"WP Inventory Manager \u003c= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute","description":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb-\u003eprepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb-\u003eget_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-18T07:39:59.742Z","modified":"2026-09-18T11:34:07.234Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-82749","description":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb-\u003eprepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb-\u003eget_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-18T07:39:59Z","modified":"2026-09-18T11:34:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:09.240281Z"}],"ghsa":[{"id":"GHSA-q2g2-xwwx-rp3m","title":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where'...","description":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb-\u003eprepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb-\u003eget_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-18T09:31:07Z","modified":"2026-09-18T09:31:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:12:09.483713Z"}],"nvd":[{"id":"CVE-2026-17607","description":"The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb-\u003eprepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb-\u003eget_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-18T08:17:00.303Z","modified":"2026-09-18T13:23:37.403Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:49.70655Z"}]}}