CVE-2026-89297

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1

Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update Loja Automática to a version newer than 1.0.0. Avoid using the id parameter in the affected plugin until the update is applied.