Zero Day MonitorZDM

← Back to list

8.6

CVE-2026-89288PATCHED

unknown · fast courier

Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

Description

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Affected Products

Vendor	Product	Versions
unknown	fast courier	5.0.0

References

https://wpscan.com/vulnerability/8b651892-fc8a-4c8b-a04d-5c76b5b85577/(exploit, vdb-entry, technical-description)

Related News (1 articles)

Tier C

VulDB1d ago

CVE-2026-89288 | Fast Courier Plugin up to 5.2.3 on WordPress REST API sql injection

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.18.6 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

5.2.4

PublishedOct 14, 2026

Last enriched1d ago

Trending Score32

Source articles1

Independent1

Info Completeness4/14

Missing: vendor, product, versions, cvss, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-74920EXPKEV

Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

CRITICALCVE-2026-109145

User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler

HIGHCVE-2026-96537

Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite

MEDIUMCVE-2026-92428

Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook

MEDIUMCVE-2026-92429

Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook

Pin to Dashboard

Verification

State: verified

Confidence: 100%

Vulnerability Timeline

CVE Published

Oct 14, 2026

Discovered by ZDM

Oct 14, 2026

Patch Available

Oct 15, 2026