CVE-2026-14238 is a SQL injection vulnerability in the vitepos WordPress plugin before version 3.6.0. The flaw arises from improper handling of an identifier extracted from a REST request body, which is directly used in a database query without sanitization or parameterization. This allows users with administrator privileges to perform SQL injection attacks via a report endpoint. The vulnerability has been assigned a medium severity rating with a CVSS 3.1 base score of 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N). No official patch or remediation level has been published yet.

An attacker with administrator-level access can exploit this vulnerability to perform SQL injection on the plugin's database queries. This could lead to partial confidentiality loss of data (read access to some database information). There is no indication of integrity or availability impact. The vulnerability affects the confidentiality of the system's data but requires high privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the vitepos plugin. Avoid exposing the vulnerable report endpoints unnecessarily.