CVE-2026-16061— Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}
Quick assessment
Affected
Unknown Rest Routes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
REST Routes WordPress 插件（版本 5.5.5 及以下）未对其公共 REST 路由 URL 中获取的某个值进行消毒和验证，就直接将其用于 SQL 查询，这使得未认证的攻击者能够执行 SQL 注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16061
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}
Source: CVE Program / CVE List V5
Vulnerability Description
The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Rest Routes | 0 ~ 5.5.5 | - |
|
II. Public POCs for CVE-2026-16061
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16061
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2026-16061 (1)
-
🔗 Rest Routes <= 5.5.5 – Unauthenticated SQLi via custom-tables/tables/{table_name} | CVE 2026-16061 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-29 · 26 CVEs total
| CVE-2026-76586 | BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment | |
| CVE-2026-10522 | Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator | |
| CVE-2026-16947 | Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Pa | |
| CVE-2026-16600 | SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_up | |
| CVE-2026-16259 | Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation | |
| CVE-2026-17520 | Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key | |
| CVE-2026-17522 | Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF | |
| CVE-2026-76546 | Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode | |
| CVE-2026-19430 | CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via downlo | |
| CVE-2026-18234 | MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet | |
| CVE-2026-18233 | MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion | |
| CVE-2026-76547 | Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export | |
| CVE-2026-76548 | Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via F | |
| CVE-2026-81026 | MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN | |
| CVE-2026-77010 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Jo | |
| CVE-2026-77012 | Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Writ | |
| CVE-2026-77008 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Setti | |
| CVE-2026-77007 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButto | |
| CVE-2026-80311 | Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via | |
| CVE-2026-80488 | WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-81026
MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass vi -
CVE-2026-81346
Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitra -
CVE-2026-81342
MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect -
CVE-2026-81200
MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Bi -
CVE-2026-77786
Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification
V. Comments for CVE-2026-16061
No comments yet