CVE-2026-12983 — Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

CVE-2026-12983

Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection PUBLISHED

Description (CNA)

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.

Affected (CNA)

Vendor / product	Versions
Unknown / Dinatur	affected 0 through 1.18

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1369f95a-4ad3-4b0e-a87f-da88d200685e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.