CVE-2026-17607

Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2

Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the [wpinventory] shortcode. The issue occurs in the WPIMItem::get all() function because the parse custom where() function fails to use $wpdb->prepare() or a whitelist, performing only basic decoding and semicolon stripping. This allows the user-supplied parameter to be concatenated into a raw SELECT statement executed via $wpdb->get results(), enabling the extraction of sensitive information from the database.

Recommendations Update WP Inventory Manager to version 2.5.2 or later. As a temporary workaround, restrict access to the [wpinventory] shortcode for users with Contributor-level permissions.