CVE-2026-17607: WP Inventory Manager SQL Injection Vulnerability

CVE-2026-17607 Overview

CVE-2026-17607 is a SQL Injection vulnerability in the WP Inventory Manager plugin for WordPress. The flaw exists in the where shortcode attribute of the [wpinventory] shortcode across all versions up to and including 2.5.1. Authenticated attackers with Contributor-level access or higher can append arbitrary SQL to existing queries and extract sensitive database contents. The root cause is insufficient escaping combined with the absence of parameterized queries in the WPIMItem::get_all() function. The vulnerability is classified under CWE-89: SQL Injection.

Critical Impact
Authenticated attackers with Contributor-level access can extract sensitive data — including user credentials and session tokens — from the WordPress database by injecting SQL into the where shortcode attribute.

Affected Products

WP Inventory Manager plugin for WordPress (versions up to and including 2.5.1)
WordPress sites permitting Contributor-level (or higher) user registration with the plugin installed
Any WordPress deployment rendering the [wpinventory] shortcode in user-controlled content

Discovery Timeline

2026-09-18 - CVE-2026-17607 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-17607

Vulnerability Analysis

The vulnerability resides in how the WP Inventory Manager plugin processes the where attribute of the [wpinventory] shortcode. When a post or page containing the shortcode is rendered, the plugin passes the where value through the parse_custom_where() helper before concatenating it into a raw SELECT statement executed via $wpdb->get_results().

The parse_custom_where() function only applies html_entity_decode(), strips semicolons, and performs field-label name replacements. It does not invoke $wpdb->prepare(), does not enforce a whitelist of allowed columns or operators, and does not encode the resulting SQL fragment. Any Contributor who can publish a draft post can embed the shortcode with a crafted where value.

Successful exploitation supports UNION-based extraction from tables such as wp_users and wp_usermeta, exposing password hashes, session tokens, and other sensitive records.

Root Cause

The root cause is unsafe SQL construction in the WPIMItem::get_all() function. User-supplied shortcode input is concatenated directly into a SELECT statement without parameterization or column-name validation. Stripping semicolons is not an adequate defense against SQL injection because UNION-based, boolean-based, and time-based payloads do not require statement terminators.

Attack Vector

An authenticated user with at least Contributor privileges creates or edits a post containing the [wpinventory] shortcode. The attacker supplies a malicious where attribute that appends arbitrary SQL clauses. When the post is previewed or published and viewed, the plugin executes the tainted query and returns injected results. The attack is network-reachable and requires no user interaction beyond authoring content the attacker already controls.

Refer to the Wordfence Vulnerability Report and the vulnerable source in wpinventory.item.class.php line 211 for technical details.

Detection Methods for CVE-2026-17607

Indicators of Compromise

Post or page content containing [wpinventory] shortcodes with unusual where= attributes referencing keywords such as UNION, SELECT, SLEEP, BENCHMARK, or information_schema.
Unexpected SELECT statements in MySQL slow query or general query logs originating from the WP Inventory Manager plugin file paths.
Sudden spikes in read activity against wp_users, wp_usermeta, or wp_options tables from the web-server database user.
New draft or pending posts created by Contributor accounts that contain the [wpinventory] shortcode.

Detection Strategies

Audit wp_posts.post_content for any occurrence of [wpinventory combined with a where= attribute, and review the payload contents for SQL keywords.
Enable MySQL general query logging temporarily and grep for queries referencing WP Inventory tables with anomalous clauses such as UNION SELECT or subqueries.
Deploy a web application firewall rule to flag HTTP responses containing rendered [wpinventory] shortcodes when the request originates from a preview or draft endpoint.

Monitoring Recommendations

Alert on any creation or modification of posts by Contributor-level accounts that include the [wpinventory] shortcode.
Baseline the query patterns generated by WPIMItem::get_all() and alert on deviations, particularly queries containing multiple SELECT clauses.
Monitor authentication logs for successful logins to Contributor or higher accounts from previously unseen IP addresses or user agents.

How to Mitigate CVE-2026-17607

Immediate Actions Required

Update the WP Inventory Manager plugin to the patched version referenced in the WordPress plugin changeset 3657730.
Audit all Contributor, Author, and Editor accounts, revoking any that are no longer required or appear suspicious.
Rotate WordPress user passwords and secret keys if evidence of exploitation exists, since password hashes may have been exfiltrated.
Review recently created or modified posts for embedded [wpinventory] shortcodes with abnormal where attributes.

Patch Information

The WP Inventory Manager maintainers addressed the issue in the changeset published to the WordPress plugin repository. Administrators should upgrade to the fixed release above 2.5.1 as identified in the WordPress plugin changeset. Confirm the plugin version in the WordPress admin dashboard after updating.

Workarounds

Deactivate the WP Inventory Manager plugin until the update can be applied.
Restrict shortcode usage by removing the unfiltered_html and shortcode privileges for Contributor and Author roles using a role-management plugin.
Add a web application firewall rule to block requests where post content includes [wpinventory combined with SQL keywords such as UNION, SELECT, or information_schema.
Set the database user for WordPress to a least-privilege account without access to unrelated schemas.

bash

# Example WP-CLI commands to identify vulnerable content and check plugin version
wp plugin get wp-inventory-manager --field=version
wp db query "SELECT ID, post_title, post_author, post_status FROM wp_posts WHERE post_content LIKE '%[wpinventory%where=%';"
wp plugin update wp-inventory-manager