CVE-2026-16950: Product Shortlist WordPress SQLi Flaw

CVE-2026-16950 Overview

CVE-2026-16950 is an unauthenticated SQL injection vulnerability in the Product Shortlist WordPress plugin through version 1.0.4. The plugin fails to sanitize and escape a user-supplied parameter before including it in a SQL statement. Attackers can inject arbitrary SQL through crafted HTTP requests without authentication. The flaw is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Because the scope is changed and confidentiality impact is high, attackers can read data outside the plugin's own storage context, including sensitive WordPress database contents.

Critical Impact
Unauthenticated attackers can extract WordPress database contents, including user credentials and session data, through crafted requests against vulnerable Product Shortlist plugin endpoints.

Affected Products

Product Shortlist WordPress plugin versions up to and including 1.0.4
WordPress installations running the vulnerable plugin
No fixed version identified in the referenced advisory

Discovery Timeline

2026-08-19 - CVE-2026-16950 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-16950

Vulnerability Analysis

The Product Shortlist plugin accepts a parameter from HTTP requests and concatenates it directly into a SQL query. The plugin does not apply WordPress sanitization functions such as sanitize_text_field() or prepared statements through $wpdb->prepare(). As a result, attackers control fragments of the SQL query executed against the WordPress database.

The issue requires no authentication and no user interaction. An attacker sends a single crafted HTTP request to a plugin endpoint on any WordPress site running the vulnerable plugin. The attack complexity is low, and the scope change reflects that injected SQL can read data belonging to the entire WordPress installation, not only plugin tables.

The WPScan Vulnerability Report documents the vulnerable parameter and confirms the lack of sanitization in versions through 1.0.4.

Root Cause

The root cause is missing input validation and unsafe SQL query construction. The plugin uses direct string concatenation instead of parameterized queries. WordPress provides $wpdb->prepare() for safe query construction, but the plugin bypasses this mechanism for the affected parameter.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker crafts a request containing SQL payloads in the vulnerable parameter. Common techniques include UNION-based extraction to enumerate database tables and time-based blind injection using SLEEP() to confirm exploitability. The current EPSS probability is 0.324%, indicating low observed exploitation activity at the time of publication.

Since no verified public exploit code is available, refer to the WPScan advisory for the specific vulnerable endpoint and parameter name.

Detection Methods for CVE-2026-16950

Indicators of Compromise

HTTP requests to Product Shortlist plugin endpoints containing SQL syntax such as UNION SELECT, SLEEP(, BENCHMARK(, or comment sequences like -- and /*
Unusual wp_users or wp_options table access patterns in MySQL query logs
Web server access logs showing long query strings with URL-encoded SQL keywords targeting plugin URLs
Unexpected outbound data transfers from WordPress hosts following inbound plugin requests

Detection Strategies

Enable MySQL general query logging and search for queries referencing plugin tables with suspicious concatenated values
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin paths
Correlate web access logs with database query logs to identify request-to-query injection patterns
Monitor WordPress error logs for SQL syntax errors, which indicate injection probing

Monitoring Recommendations

Alert on HTTP requests to Product Shortlist plugin URLs containing SQL metacharacters
Track authentication anomalies following suspicious plugin requests, as extracted credentials may be reused
Baseline normal plugin traffic volume and alert on request spikes from single source IPs

How to Mitigate CVE-2026-16950

Immediate Actions Required

Deactivate and remove the Product Shortlist plugin from all WordPress installations until a patched version is confirmed
Rotate WordPress administrator passwords and secret keys defined in wp-config.php if the plugin was exposed to the internet
Review wp_users for unauthorized administrator accounts created after plugin installation
Audit database access logs for evidence of data extraction against the affected sites

Patch Information

The referenced advisory identifies versions through 1.0.4 as vulnerable. Consult the WPScan Vulnerability Report for updates on a fixed release. Apply the patched version through the WordPress plugin dashboard once available.

Workarounds

Block requests to the Product Shortlist plugin path at the web application firewall or reverse proxy layer
Restrict database user privileges so the WordPress database account cannot read tables outside its required scope
Enable WAF rules targeting SQL injection patterns for all /wp-content/plugins/ paths
Place the WordPress site behind an authenticated access gateway if the plugin functionality is not required for public visitors

bash

# Example nginx rule to block SQL injection patterns targeting the plugin
location ~* /wp-content/plugins/product-shortlist/ {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|/\*)") {
        return 403;
    }
}