ASPL Product Quotation CVE-2026-89287

The target site must have the ASPL Product Quotation WordPress plugin installed and active at version 1.1.0 or earlier; the description does not name the specific vulnerable parameter or endpoint, but states the injection is reachable by unauthenticated attackers with no special configuration mentioned. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction is required and exploitation works against the standard plugin install. The primary limiting factor is deployment scope - exploitation is only possible where this specific, relatively uncommon plugin is present and not yet updated; impact is confined to confidentiality (read-only data disclosure), with no stated write/integrity or availability effect.

Multiple signals align toward genuine priority but with important caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the worst-case access profile - and the C:H/I:N/A:N impact plus S:C scope change yields the 8.6 (High) score. The flaw is an unauthenticated SQL injection (CWE-89) and publicly available exploit code exists (reported by WPScan), so the barrier to weaponization is already low. However, no CISA KEV listing is present and no EPSS score was supplied in the input, so there is no direct evidence of active exploitation or a quantified probability - POC availability must NOT be conflated with in-the-wild use. The key mitigating signal is prevalence: ASPL Product Quotation is a niche WordPress plugin, so even with a high CVSS and a public POC, the real-world blast radius is likely limited to the relatively small population of sites running it. Net assessment: a real, patch-worthy issue for any organization running this specific plugin (unauthenticated data disclosure with public exploit), but not a broad internet-wide emergency given the limited deployment footprint. Missing data to verify: EPSS probability and any KEV/active-exploitation confirmation.

A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable WordPress site, injecting SQL through the unsanitized parameter in the ASPL Product Quotation plugin (≤1.1.0). Because AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are needed, and the attacker extracts arbitrary database contents such as user records and password hashes. Public exploit code exists (WPScan), lowering the skill required to reproduce the attack.