SaveTo Wishlist Lite CVE-2026-89236

No authentication, user interaction, or special configuration is required: any internet-reachable WordPress site running SaveTo Wishlist Lite prior to 1.1.5 is exploitable in its default state by sending a request that controls the parameter placed in the query's ORDER BY clause. The practical limits on exploitation are: (1) the target must have this specific plugin installed and activated at a version below 1.1.5, which is the primary scoping constraint given the plugin's niche footprint; and (2) impact is bounded to confidentiality - the ORDER BY injection permits reading/extracting database data but, per SSVC 'partial' technical impact and the CVSS I:N/A:N, does not inherently grant data modification or code execution.

This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw, and publicly available exploit code (WPScan) plus an SSVC 'Automatable: yes' rating mean it can be scripted and sprayed at scale. Counterbalancing this, EPSS is only 0.17% (6th percentile), the vulnerability is NOT in CISA KEV, and SSVC records Exploitation as 'none' - so despite POC availability there is no evidence of active exploitation in the wild yet, and SSVC Technical Impact is only 'partial' (read-only data disclosure, no write/RCE). The vendor CVSS of 8.6 is inflated primarily by the Scope:Changed designation; the real-world impact is confidentiality-only database read access. Note one signal tension: the high CVSS/automatable rating argues for prompt patching, while low EPSS and 'Exploitation: none' argue it is not yet being mass-exploited - treat it as 'patch soon' rather than 'patch tonight'. The affected product is a niche WordPress wishlist plugin, which constrains the overall blast radius.

A remote, unauthenticated attacker identifies a WordPress site running SaveTo Wishlist Lite below 1.1.5 and sends a crafted request manipulating the plugin parameter used in a SQL ORDER BY clause. Because the parameter is not sanitised, the attacker appends subqueries (e.g., via UNION/stacked logic) to read arbitrary database tables, extracting user data, password hashes, and secret keys. A public WPScan exploit entry exists, lowering the skill barrier to weaponize this.