CVE-2026-87767 — WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url

CVE-2026-87767

WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url PUBLISHED

Description (CNA)

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / wp shortcut link and advertisement baner	affected 0 through 1.2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1d103d80-1904-4aae-87b1-06a429ca85c9/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.