CVE-2026-89288— Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
Quick assessment
Affected
Unknown Fast Courier
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Fast Courier WordPress 插件版本 5.2.4 之前，存在一个未授权 REST 端点，该端点在将数据用于 SQL 查询前未对其进行适当的清理和转义处理。这导致未认证的攻击者可以执行 SQL 注入攻击，从而读取数据库中的任意数据。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Fast Courier | 5.0.0< 5.2.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89288
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Fast Courier | 5.0.0 ~ 5.2.4 | - |
|
II. Public POCs for CVE-2026-89288
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89288
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-14 · 47 CVEs total
| CVE-2026-103308 | 6.5 MEDIUM | Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosu |
| CVE-2026-97315 | 5.4 MEDIUM | Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email |
| CVE-2026-88998 | 5.3 MEDIUM | Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN |
| CVE-2026-82844 | 5.3 MEDIUM | WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce |
| CVE-2026-101301 | 5.3 MEDIUM | WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass |
| CVE-2026-104751 | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion | |
| CVE-2026-108066 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | |
| CVE-2026-106166 | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_en | |
| CVE-2026-103307 | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment | |
| CVE-2026-106098 | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update | |
| CVE-2026-105261 | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateforma | |
| CVE-2026-107126 | WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header | |
| CVE-2026-107178 | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptio | |
| CVE-2026-107160 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection | |
| CVE-2026-107158 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integrati | |
| CVE-2026-106646 | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Ga | |
| CVE-2026-107320 | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure | |
| CVE-2026-107508 | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter | |
| CVE-2026-107594 | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | |
| CVE-2026-104644 | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Config |
Showing top 20 of 47 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-92429
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Or -
CVE-2026-92428
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order St -
CVE-2026-103324
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Un -
CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish -
CVE-2026-74920
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode
V. Comments for CVE-2026-89288
No comments yet