Is CVE-2026-89235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89235 being exploited in the wild.

How severe is CVE-2026-89235?

Medium severity, with a CVSS score of 6.8, published 9 October 2026.

Which products and versions are affected?

BestWebSoft Testimonials 1.0.5 through 1.0.8.

Is there a fix for CVE-2026-89235?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89235 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89235?

Check whether you run BestWebSoft Testimonials at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89235: Testimonials by BestWebSoft SQL injection via offset parameter

CVE-2026-89235 · Severity: medium · CVSS 6.8 · Published 2026-10-09

The Testimonials by BestWebSoft WordPress plugin, used to display customer testimonials on websites, contains an unauthenticated SQL injection vulnerability in the offset parameter. An attacker can craft a malicious request to extract or modify sensitive data stored in the WordPress database, including user credentials and site information, without requiring any login credentials.

Vendors: BestWebSoft.

Quick answers

Is CVE-2026-89235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89235 being exploited in the wild.
How severe is CVE-2026-89235?: Medium severity, with a CVSS score of 6.8, published 9 October 2026.
Which products and versions are affected?: BestWebSoft Testimonials 1.0.5 through 1.0.8.
Is there a fix for CVE-2026-89235?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89235 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89235?: Check whether you run BestWebSoft Testimonials at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to sanitize and escape the 'offset' parameter before including it in SQL queries (CWE-89). This allows unauthenticated attackers to inject arbitrary SQL through a network request. The vulnerability affects versions 1.0.5 through 1.0.8, and no patch is currently available.

Affected products

BestWebSoft Testimonials 1.0.5 through 1.0.8

Timeline

2026-10-06: disclosed
2026-10-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.