Executive brief
WP Inventory Manager is a WordPress plugin used to manage and display product inventories on websites. A security vulnerability in this plugin allows an attacker with basic user permissions to perform blind SQL injection, which could lead to the unauthorized extraction of sensitive information from the site's database. This could result in the exposure of customer data, administrative credentials, or other confidential business information.
Technical details
A Blind SQL Injection vulnerability exists in the WP Inventory Manager plugin for WordPress (versions <= 2.4.0) due to improper neutralization of special elements used in SQL commands. The flaw allows an authenticated attacker with 'Contributor' level privileges or higher to send specially crafted requests to the server. Because the application does not properly sanitize these inputs before using them in database queries, the attacker can infer the contents of the database by observing differences in application responses or timing. As of the advisory date, no official patch has been released.
Affected products
- WP Inventory WP Inventory Manager <= 2.4.0
Timeline
- 2026-05-08: other: Vulnerability reported by researcher dodoh4t
- 2026-07-02: advisory: Initial advisory published by Patchstack
- 2026-07-13: disclosed: CVE published to NVD