CVE-2026-16061: CWE-89 SQL Injection in Rest Routes

The Rest Routes WordPress plugin versions through 5.5.5 contain a SQL injection vulnerability (CWE-89) due to improper sanitization and validation of a URL parameter used in a SQL query within a public REST route. This flaw allows unauthenticated remote attackers to inject SQL commands, potentially exposing sensitive data. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the WordPress site's database via a public REST route. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact data integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected REST routes or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the plugin's endpoints.