CVE-2026-89297: CWE-89 SQL Injection in Loja Automática

CVE-2026-89297 is a SQL injection vulnerability in the Loja Automática WordPress plugin through version 1.0.0. The plugin fails to properly sanitize and escape user-supplied input before incorporating it into SQL queries, enabling unauthenticated attackers to inject malicious SQL code. This vulnerability is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No CVSS score is provided, and no known exploits are reported in the wild. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to manipulate the plugin's database queries. This may lead to unauthorized data access, data modification, or other impacts typical of SQL injection vulnerabilities. However, specific impacts such as data disclosure or privilege escalation are not detailed in the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or restricting access to it to mitigate potential exploitation.