CVE-2026-16061 — Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

CVE-2026-16061

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name} PUBLISHED

Description (CNA)

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / Rest Routes	affected 0 through 5.5.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a5114034-797c-44cd-ba9b-6ab3655fd3e8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.