CVE-2026-89235: CWE-89 SQL Injection in Testimonials by BestWebSoft
Description
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
CVSS v3.1
Score 6.8medium
Affected software
Testimonials by BestWebSoft
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89235 is a SQL injection vulnerability in the Testimonials by BestWebSoft WordPress plugin versions 1.0.5 through 1.0.8. The plugin fails to sanitize and escape a parameter before including it in a SQL query, enabling unauthenticated attackers to inject arbitrary SQL code. This can lead to unauthorized data exposure or manipulation. The vulnerability has been assigned a CVSS v3.1 score of 6.8, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact. No official patch or vendor advisory is provided in the input data.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to append arbitrary SQL commands to a query executed by the plugin, potentially leading to unauthorized disclosure of sensitive information from the database. The CVSS vector indicates high confidentiality impact but no impact on integrity or availability. There is no indication of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable plugin functionality or disabling the plugin if possible to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-11T09:39:35.072Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac8cda92cdf04f6564f74b7
Added to database: 10/09/2026, 11:19:05 UTC
Last enriched: 10/09/2026, 11:33:16 UTC
Last updated: 10/09/2026, 18:57:32 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.