Testimonials by BestWebSoft CVE-2026-89235

Requires the Testimonials by BestWebSoft plugin (version ≤1.0.8) to be installed and active on a WordPress site, with the vulnerable testimonials-handling endpoint reachable over the network. The CVE description does not name a specific non-default setting, so exploitation appears possible against default installations without authentication or user interaction (PR:N/UI:N). Limiting factors: impact is confined to confidentiality (database read); the input CVSS claims high attack complexity (AC:H), which if accurate implies some non-trivial precondition or timing/configuration dependency, though the description gives no such detail and typical unsanitized-parameter SQLi is low-complexity.

This is a moderate-priority issue whose signals are mostly consistent but modest. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, base 6.8) describes an unauthenticated, network-reachable SQL injection yielding confidentiality impact only - no integrity or availability loss. A public proof-of-concept exists (WPScan), which raises practical exploitability, but the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are largely aligned (info-disclosure SQLi with a published PoC) rather than conflicting, but two things warrant scrutiny: the input vector sets AC:H, which is unusual for a classic unsanitized-parameter SQLi (these are normally low-complexity), and it sets S:C (scope change), which is questionable because SQL injection typically affects only the vulnerable database component - both choices appear to inflate/distort the vector and should be verified against the WPScan advisory. Net: a real but not urgent issue - exposed, unauthenticated data-read risk on affected sites, but no KEV listing and no exploitation-probability data to suggest mass exploitation.

An unauthenticated remote attacker sends a crafted HTTP request to a WordPress site running Testimonials by BestWebSoft ≤1.0.8, injecting additional SQL into a vulnerable parameter to read data from the database (e.g., user records or password hashes). A public proof-of-concept is available via WPScan, lowering the barrier to weaponization.