Rest Routes CVE-2026-16061

No authentication, user interaction, or special privileges are required; the vulnerable REST route is deliberately public-facing and accessible by design to unauthenticated HTTP clients. The sole prerequisite is that the Rest Routes plugin version 5.5.5 or earlier is installed and active on a network-reachable WordPress site. No non-default configuration is required to trigger the vulnerability. The primary limiting factor for exploitation is the plugin's installed base - only sites actively running this specific plugin are exposed. The CVSS confidentiality-only impact profile (C:H/I:N/A:N) with scope change suggests the injection enables read-only SQL operations (data exfiltration from the WordPress database) rather than data modification or remote code execution, which limits the severity of achievable impact per successful exploitation.

The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) classifies this as high severity: remotely exploitable, no authentication required, low complexity, and a scope change indicating database access beyond the plugin's immediate trust boundary. The confidentiality-only impact (C:H/I:N/A:N) is consistent with a read-oriented SQL injection - likely SELECT-based data exfiltration rather than write or command execution, which caps practical damage compared to a full read-write injection. The publicly available PoC confirmed by WPScan lowers the skill barrier significantly. However, EPSS at 0.18% (7th percentile) is strikingly low for a no-auth network-exploitable SQLi with a PoC, strongly suggesting that the plugin's niche installed base - not technical difficulty - is the primary brake on widespread exploitation. The CVE is not in CISA KEV at time of analysis, consistent with targeted rather than mass exploitation. For any site actively running this plugin, the combination of zero-auth requirement, public REST exposure, and existing PoC makes exploitation straightforwardly plausible; the low EPSS should not be used to deprioritize remediation on affected instances.

An unauthenticated attacker discovers a WordPress site running Rest Routes by fingerprinting the REST API namespace and sends a crafted HTTP request to the vulnerable public REST endpoint with SQL metacharacters injected into a URL parameter. The injected query causes the WordPress database to return sensitive records - including user credentials, email addresses, and stored plugin data - directly in the HTTP response or via time-based or error-based inference. A public proof-of-concept is available via WPScan, meaning this attack can be executed with minimal expertise.