CVE-2026-12983 describes a SQL injection vulnerability (CWE-89) in the Dinatur WordPress plugin through version 1.18. The plugin fails to sanitize and escape user input before incorporating it into SQL queries, allowing unauthenticated attackers to execute SQL injection attacks. Furthermore, the same handler allows unauthenticated users to truncate the plugin's database tables without any authorization, effectively wiping stored data. This vulnerability is present in all versions from 0 up to and including 1.18.

An unauthenticated attacker can exploit the SQL injection vulnerability to manipulate database queries, potentially leading to unauthorized data access or modification. Moreover, the lack of authorization checks on the database truncation functionality allows any unauthenticated visitor to delete all data managed by the Dinatur plugin, resulting in data loss. The CVSS score of 8.6 (high severity) reflects the critical nature of these impacts, particularly the ability to cause data destruction without authentication.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it to prevent exploitation. Monitor official Dinatur plugin channels for updates addressing this vulnerability.