WP Inventory Manager CVE-2026-76005

Requires an authenticated account with Contributor-level privileges or higher (PR:L) on a site where WP Inventory Manager ≤2.5.5 is installed and active. The concrete trigger named in the description is the 'sort_order' attribute of the [wpinventory_categories] shortcode, placed in a draft post and rendered via post preview - exploitation does NOT require the post to be published or approved, which lowers the barrier on multi-author/membership sites. Limiting factors: the attacker must already authenticate at contributor level (not anonymous), exploitation on single-author sites is impractical without an account, and because the injection is time-based/blind, data extraction is slow and noisy rather than instantaneous bulk dumping. Impact is confined to reading database contents; no write/integrity or availability impact is indicated.

This is a moderate, authentication-gated risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity attack that nonetheless requires authenticated access at contributor level (PR:L) and yields confidentiality-only impact (C:H, I:N, A:N) - consistent with a blind/time-based SQL injection used to read data, not to alter it or take down the site. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the authentication requirement and the absence of stronger urgency signals. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data, so exploitation is not confirmed to be probable or occurring. The one point to verify is the privilege boundary: the vuln is reachable by a Contributor via the draft-preview path without publishing, which lowers the practical bar for any site that grants contributor accounts (e.g., multi-author blogs, membership sites) - on such sites the PR:L requirement is weak, whereas on single-author sites it is a strong limiter. No key signals conflict here; the main gap is missing EPSS/KEV/PoC data, meaning likelihood of real-world exploitation cannot be quantified from the input.

An attacker who holds (or registers for) a Contributor account on a WordPress site running WP Inventory Manager ≤2.5.5 creates a draft post containing the [wpinventory_categories] shortcode with a malicious 'sort_order' attribute carrying time-based SQL payloads. Rendering the draft through the post preview triggers the injected query - no publication or admin approval needed - letting the attacker infer database contents (e.g., user hashes, secrets) byte-by-byte through response-timing differences. No public exploit identified at time of analysis, but the technique is straightforward given the documented trigger.