PT-2026-110059 · WordPress · Datalist It
CVE-2026-89285
·
Published
2026-10-11
·
Updated
2026-10-16
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Datalist it versions prior to 0.0.4
Description
The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection attacks via the
dli fronted action parameter to read arbitrary data from the database.Recommendations
Update Datalist it to a version newer than 0.0.3.
As a temporary workaround, restrict access to the
dli fronted action parameter to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datalist It