CVE-2026-16061: Rest Routes WordPress Plugin SQLi Vulnerability

CVE-2026-16061 Overview

CVE-2026-16061 is an unauthenticated SQL injection vulnerability in the Rest Routes WordPress plugin through version 5.5.5. The plugin fails to sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query. Unauthenticated attackers can inject arbitrary SQL statements by manipulating the vulnerable URL parameter. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Because the REST route is public and requires no authentication, any remote attacker with network access to the WordPress site can exploit the issue.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including WordPress user credentials and session tokens, via crafted requests to a public REST route.

Affected Products

Rest Routes WordPress plugin versions up to and including 5.5.5
WordPress installations exposing the plugin's public REST routes
Any site running the plugin prior to a vendor-supplied fix

Discovery Timeline

2026-08-29 - CVE-2026-16061 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-16061

Vulnerability Analysis

The Rest Routes plugin registers one or more public REST API endpoints under the standard /wp-json/ prefix. One of these routes accepts a value from the URL and passes it directly into a SQL query executed against the WordPress database. The plugin does not apply WordPress sanitization helpers such as sanitize_text_field() or esc_sql(), nor does it use parameterized queries via $wpdb->prepare(). The result is a classic SQL injection primitive reachable without authentication.

Exploitation allows attackers to alter the intended query structure, append UNION-based payloads, or use boolean and time-based inference techniques to enumerate database contents. Because WordPress stores password hashes and session identifiers in the wp_users and wp_usermeta tables, successful injection typically leads to account takeover of administrative users.

Root Cause

The root cause is missing input validation and unsafe query construction. User-controlled input from a REST route URL is concatenated into a SQL statement without prepared statements or type coercion. This matches [CWE-89] and reflects a failure to follow the WordPress $wpdb prepared-query pattern documented in the WordPress developer handbook.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker issues an HTTP request to the plugin's public REST endpoint with a malicious value embedded in the URL path or query string. The server processes the request, executes the tainted query, and returns data or observable side effects that the attacker uses to exfiltrate database content. For technical specifics on the affected route, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16061

Indicators of Compromise

Requests to /wp-json/ endpoints registered by the Rest Routes plugin containing SQL metacharacters such as ', ", --, UNION, SLEEP(, or BENCHMARK(.
Unusual response latency on plugin REST routes consistent with time-based blind SQL injection probing.
Web server access logs showing repeated requests from a single source enumerating IDs or iterating payloads against the plugin route.
Unexpected new administrator accounts or password hash changes in the wp_users table following suspicious REST traffic.

Detection Strategies

Deploy a web application firewall rule that inspects requests to plugin REST paths for SQL injection signatures and blocks or logs matches.
Enable WordPress database query logging and alert on queries executed by the plugin that contain concatenated user input.
Correlate HTTP 200 responses with anomalously large payload sizes on plugin endpoints, which can indicate successful UNION-based extraction.

Monitoring Recommendations

Monitor authentication logs for administrator logins from new IP addresses or geolocations after suspicious REST activity.
Track WordPress file integrity for changes to wp-config.php, theme files, and the mu-plugins directory that often follow database-driven compromise.
Alert on outbound connections from the web server to unfamiliar hosts, which can indicate secondary tooling deployed after initial exploitation.

How to Mitigate CVE-2026-16061

Immediate Actions Required

Identify all WordPress sites running the Rest Routes plugin and confirm the installed version against the affected range through 5.5.5.
Deactivate and remove the plugin on any site that does not require it until a patched version is confirmed installed.
Rotate all WordPress administrator passwords and invalidate active sessions by regenerating authentication salts in wp-config.php.
Review the wp_users and wp_options tables for unauthorized accounts, altered roles, or injected siteurl values.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Administrators should monitor the WPScan Vulnerability Report and the plugin's official WordPress.org listing for a vendor release addressing versions after 5.5.5. Apply the update through the WordPress admin dashboard or via WP-CLI as soon as it becomes available.

Workarounds

Block or restrict access to the vulnerable plugin REST route at the web server or reverse proxy layer until a patch is applied.
Deploy a WAF signature that rejects SQL metacharacters in URL parameters targeting /wp-json/ paths associated with the plugin.
Enforce least-privilege database credentials for the WordPress site so the plugin's database user cannot access unrelated schemas.
Take a verified backup of the database and site files before applying changes so recovery is possible if compromise is later detected.

bash

# Example nginx location block to restrict the vulnerable REST namespace
# Replace <plugin-namespace> with the actual REST namespace exposed by Rest Routes
location ~ ^/wp-json/<plugin-namespace>/ {
    allow 10.0.0.0/8;
    deny all;
}