WP Verify API CVE-2026-89299

No special conditions beyond having the plugin installed - remote unauthenticated exploitation (PR:N/UI:N) is possible against default configurations of any WordPress site running the WP Verify API plugin version 1.0.0 or earlier, by sending a request with a malicious value in the unsanitized parameter used in the SQL query. The only practical limiting factor is reachability: the target must have this specific, niche plugin installed and its vulnerable endpoint exposed; no authentication, user interaction, or non-default setting is required.

The input CVSS of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects an easy-to-reach flaw: network-based, low complexity, no privileges and no user interaction, meaning any remote unauthenticated actor who can reach the plugin's vulnerable endpoint can attempt exploitation. The 8.6 rating is materially inflated by the Scope:Changed metric; a conventional WordPress plugin SQL injection against its own backing database normally scores S:U (~7.5), so verify whether the WPScan/VulDB entry truly justifies a scope change or whether it is an over-assignment. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but this is NOT the same as active exploitation - the CVE is not listed in CISA KEV and no EPSS probability was provided, so there is no evidence of widespread or automated in-the-wild use yet. The dominant mitigating factor is prevalence: 'WP Verify API' is an obscure, low-footprint plugin at version 1.0.0, so the real-world blast radius is small. Net assessment: a genuinely high-severity, low-barrier vulnerability for the specific sites running this plugin and worth prompt patching there, but not an internet-wide emergency given the limited deployment and absence of KEV/EPSS signals.

A remote unauthenticated attacker identifies a WordPress site running WP Verify API ≤1.0.0 and sends a crafted request to the vulnerable endpoint, injecting malicious SQL into the unsanitized parameter. Because public exploit code exists (WPScan), the attacker can readily enumerate and exfiltrate database contents such as user records and password hashes. No authentication, user interaction, or special timing is required given AV:N/AC:L/PR:N/UI:N.