Is CVE-2026-17607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17607 being exploited in the wild.

How severe is CVE-2026-17607?

Medium severity, with a CVSS score of 6.5, published 18 September 2026.

Which products and versions are affected?

WP Inventory Manager WP Inventory Manager up to 2.5.1.

Is there a fix for CVE-2026-17607?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-17607 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-17607?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17607: WP Inventory Manager SQL injection in shortcode

CVE-2026-17607 · Severity: medium · CVSS 6.5 · Published 2026-09-18

The WP Inventory Manager WordPress plugin is vulnerable to SQL injection through a shortcode parameter, allowing authenticated contributors to extract sensitive data from the site's database. An attacker with contributor-level access can craft malicious shortcode attributes to bypass query protections and execute unauthorized database queries, risking exposure of customer information, credentials, and other confidential records stored in the database.

Quick answers

Is CVE-2026-17607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17607 being exploited in the wild.
How severe is CVE-2026-17607?: Medium severity, with a CVSS score of 6.5, published 18 September 2026.
Which products and versions are affected?: WP Inventory Manager WP Inventory Manager up to 2.5.1.
Is there a fix for CVE-2026-17607?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-17607 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-17607?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WPIMItem::get_all() function, specifically in the parse_custom_where() method that processes the 'where' shortcode attribute. The function performs insufficient input validation—only applying html_entity_decode(), stripping semicolons, and performing field-name replacements—without using $wpdb->prepare() parameterized queries or a whitelist. The unsanitized parameter is directly concatenated into a raw SELECT statement executed via $wpdb->get_results(). Exploitation requires authenticated access with Contributor role or higher. An attacker can append arbitrary SQL queries to extract sensitive database information. Patches are available in versions after 2.5.1.

Affected products

WP Inventory Manager WP Inventory Manager up to 2.5.1

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.