CVE-2026-4935: CWE-89 SQL Injection in OttoKit: All-in-One Automation Platform
CVE-2026-4935 is a high-severity SQL injection vulnerability in the OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23. The plugin fails to properly sanitize user input before incorporating it into SQL statements, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability can lead to unauthorized access to sensitive data but does not affect data integrity or availability. No official patch or remediation guidance has been confirmed yet.
AI Analysis
Technical Summary
The OttoKit WordPress plugin prior to version 1.1.23 contains a SQL injection vulnerability (CWE-89) due to improper sanitization of user-supplied input used in SQL queries. This flaw allows remote, unauthenticated attackers to inject malicious SQL code, potentially exposing sensitive information from the database. The vulnerability has a CVSS v3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information currently available to confirm remediation status.
Potential Impact
Successful exploitation of this vulnerability could allow attackers to retrieve sensitive information from the database without authentication. The impact is limited to confidentiality as integrity and availability are not affected according to the CVSS vector. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to reduce exposure. Monitor official sources for updates and apply patches promptly once available.
CVE-2026-4935: CWE-89 SQL Injection in OttoKit: All-in-One Automation Platform
Description
CVE-2026-4935 is a high-severity SQL injection vulnerability in the OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23. The plugin fails to properly sanitize user input before incorporating it into SQL statements, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability can lead to unauthorized access to sensitive data but does not affect data integrity or availability. No official patch or remediation guidance has been confirmed yet.
CVSS v3.1
Score 8.6high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OttoKit WordPress plugin prior to version 1.1.23 contains a SQL injection vulnerability (CWE-89) due to improper sanitization of user-supplied input used in SQL queries. This flaw allows remote, unauthenticated attackers to inject malicious SQL code, potentially exposing sensitive information from the database. The vulnerability has a CVSS v3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information currently available to confirm remediation status.
Potential Impact
Successful exploitation of this vulnerability could allow attackers to retrieve sensitive information from the database without authentication. The impact is limited to confidentiality as integrity and availability are not affected according to the CVSS vector. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to reduce exposure. Monitor official sources for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-03-26T20:00:09.059Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fd8104cbff5d86109f55cc
Added to database: 05/08/2026, 06:21:56 UTC
Last enriched: 05/15/2026, 10:57:25 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.