CVE-2026-89288 — Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

CVE-2026-89288

Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter PUBLISHED

Description (CNA)

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / Fast Courier	affected 5.0.0 before 5.2.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8b651892-fc8a-4c8b-a04d-5c76b5b85577/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.