CVE-2026-89285 — Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action

CVE-2026-89285

Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action PUBLISHED

Description (CNA)

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / Datalist it	affected 0 through 0.0.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/27135434-79e0-4f9e-aecf-c7092faec29b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.