PT-2026-64843

CVE-2026-14189

Published

2026-07-06

Updated

2026-07-27

Description by

CVSS 3.1

3.8

Low

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPBot versions prior to 8.5.2

Description This issue is a second-order SQL injection where the plugin fails to validate field identifiers configured by an administrator before incorporating them into a SQL query. The injection is triggered when a visitor performs a search operation. The vulnerable variable is qc bot str fields.

Recommendations Update to version 8.5.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mustafa Ahmed

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers