CVE-2026-12983 describes a vulnerability in the Dinatur WordPress plugin through version 1.18 where user input is not properly sanitized or escaped before being used in SQL queries, leading to SQL injection (CWE-89). Furthermore, the same request handler permits unauthenticated users to truncate database tables without any authorization checks, resulting in potential data loss. There is no information about a patch or fix, and no known exploits have been reported in the wild.

An attacker can perform SQL injection attacks without authentication, potentially manipulating or extracting sensitive data from the plugin's database. Moreover, unauthenticated attackers can delete all data managed by the Dinatur plugin by truncating its database tables, causing denial of service or data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it to prevent exploitation.