CVE-2026-89235: Testimonials by BestWebSoft SQLi Flaw

CVE-2026-89235 Overview

CVE-2026-89235 is a SQL injection vulnerability affecting the Testimonials by BestWebSoft WordPress plugin through version 1.0.8. The plugin fails to sanitize and escape a user-supplied parameter before placing it into a SQL query. Unauthenticated attackers can append additional SQL statements to the original query over the network. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive data from the WordPress database by injecting SQL into a vulnerable parameter in the Testimonials by BestWebSoft plugin.

Affected Products

Testimonials by BestWebSoft WordPress plugin versions through 1.0.8
WordPress sites with the plugin installed and activated
Any hosting environment serving the vulnerable plugin version

Discovery Timeline

2026-10-09 - CVE CVE-2026-89235 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-89235

Vulnerability Analysis

The Testimonials by BestWebSoft plugin accepts a parameter and incorporates it directly into a SQL query without applying input sanitization or output escaping. Because WordPress plugins typically interact with the underlying database through the $wpdb abstraction, developers must explicitly use prepared statements or escaping helpers such as $wpdb->prepare() or esc_sql(). This plugin omits those safeguards for the affected parameter.

An attacker does not need valid credentials to reach the vulnerable code path. The request can be issued directly against the plugin endpoint over the network. Successful injection enables data exfiltration from any table accessible to the WordPress database user, including the wp_users and wp_usermeta tables that store credential hashes and session tokens.

The EPSS exploit prediction remains low at the time of publication, but SQL injection in WordPress plugins is commonly weaponized once proof-of-concept details circulate.

Root Cause

The root cause is missing input validation on a parameter passed from an HTTP request into a dynamically constructed SQL statement. The plugin concatenates untrusted input into the query string rather than using parameterized queries. This pattern maps directly to CWE-89.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker crafts an HTTP request containing SQL syntax inside the vulnerable parameter. The injected SQL is appended to the original query and executed by the database. See the WPScan Vulnerability Report for request-level technical details.

Detection Methods for CVE-2026-89235

Indicators of Compromise

HTTP requests to Testimonials plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, AND 1=1, or encoded variants like %27 and %20OR%20.
Unexpected SELECT statements referencing wp_users, wp_usermeta, or wp_options originating from the Testimonials plugin's PHP context.
Spikes in slow database queries or connection errors correlated with requests to plugin URLs.
Outbound connections from the WordPress host immediately after suspicious requests, suggesting data exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that match SQL injection payloads in query strings and POST bodies targeting the plugin.
Enable MySQL general or slow query logging and alert on queries containing concatenated SQL fragments tied to plugin parameters.
Correlate PHP error logs with HTTP access logs to find syntax errors returned by the database engine.
Monitor WordPress plugin inventory for the vulnerable version 1.0.8 and earlier.

Monitoring Recommendations

Forward WordPress, PHP, Apache or Nginx, and MySQL logs into a centralized analytics platform for correlation.
Baseline normal request patterns to the testimonials endpoints and alert on deviations in parameter length or character composition.
Track authentication failures and privilege-sensitive database queries following requests to the plugin.

How to Mitigate CVE-2026-89235

Immediate Actions Required

Identify every WordPress site running Testimonials by BestWebSoft and inventory the installed version.
Deactivate and uninstall the plugin on sites running version 1.0.8 or earlier until a patched release is applied.
Rotate WordPress administrator passwords and database credentials if indicators of exploitation are present.
Review database audit logs for unauthorized SELECT or UNION activity against sensitive tables.

Patch Information

No fixed version is listed in the published advisory at the time of writing. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for an updated release addressing CVE-2026-89235. Apply the vendor patch as soon as it becomes available and verify the plugin version post-upgrade.

Workarounds

Remove the plugin until a patched version is released.
Deploy WAF signatures that block SQL injection payloads targeting plugin query parameters.
Restrict database user privileges so the WordPress account cannot read tables outside its required scope.
Place the WordPress admin interface behind IP allow-listing or VPN access to reduce exposure of related endpoints.

bash

# Example ModSecurity rule to block common SQLi patterns on the plugin endpoint
SecRule REQUEST_URI "@contains /wp-content/plugins/testimonials-by-bestwebsoft/" \
    "id:1026089235,phase:2,deny,status:403,msg:'Block SQLi attempt on vulnerable Testimonials plugin',\
    chain"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|or\s+1=1|--\s|#)" \
      "t:none,t:urlDecodeUni"