CVE-2026-89236

{
  "etk_id": "ETK-2026-594",
  "cve_id": "CVE-2026-89236",
  "display_id": "CVE-2026-89236",
  "ghsa_id": "GHSA-fjqm-j5cq-22m7",
  "euvd_id": "EUVD-2026-91943",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in SaveTo Wishlist Lite",
  "summary": "SaveTo Wishlist Lite for WordPress versions before 1.1.5 are affected by an SQL injection flaw in query ordering input handling. An unauthenticated attacker may be able to read sensitive information from the WordPress database by reaching the vulnerable functionality.",
  "mitigation": "Update SaveTo Wishlist Lite to version 1.1.5 or later. Until it is updated, restrict public access to the affected WordPress site or disable the plugin to reduce exposure.",
  "vendor": null,
  "product": "SaveTo Wishlist Lite",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.1.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.1.5"
      ],
      "package_name": "SaveTo Wishlist Lite",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.6,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1767,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 23.050641466666665,
  "t0_at": "2026-10-03T06:00:27.001000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T22:09:53.239606+00:00",
      "days": 1.673220354236111,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:27.001000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T06:00:27.001000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:27.001000+00:00",
      "url": "https://github.com/advisories/GHSA-fjqm-j5cq-22m7"
    }
  }
}