AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-14238

MEDIUM · CVSS 4.1 EPSS 0.19%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The vitepos WordPress plugin prior to version 3.6.0 is vulnerable to SQL injection due to inadequate sanitization of an identifier from a REST request body, which can be exploited by users with administrator-level access. This vulnerability could lead to unauthorized database manipulation, potentially compromising sensitive data. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk.

CVE
CVE-2026-14238
Severity
MEDIUM
CVSS
4.1
EPSS
0.19%
WordPress

Original NVD Description

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.