CVE-2026-89288: Fast Courier WordPress Plugin SQLi Flaw

CVE-2026-89288 Overview

CVE-2026-89288 is an unauthenticated SQL injection vulnerability in The Fast Courier WordPress plugin versions before 5.2.4. The plugin fails to sanitize and escape a user-supplied value before using it in a SQL query on an unauthenticated REST route. Attackers can inject arbitrary SQL and read sensitive data from the WordPress database without authentication. The exposed REST endpoint removes any authentication barrier, making the flaw reachable by any remote actor. The vulnerability is tracked as a classic SQL injection weakness [CWE-89].

Critical Impact
Unauthenticated remote attackers can extract arbitrary data from the WordPress database, including user credentials, session tokens, and configuration secrets stored in wp_options.

Affected Products

The Fast Courier WordPress plugin versions prior to 5.2.4
WordPress sites exposing the plugin's unauthenticated REST route
Shipping and courier integrations relying on the vulnerable plugin

Discovery Timeline

2026-10-14 - CVE-2026-89288 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-89288

Vulnerability Analysis

The Fast Courier plugin registers a REST API route that accepts input parameters and passes them directly into a SQL query. The handler does not call WordPress sanitization functions such as sanitize_text_field() and does not use $wpdb->prepare() with placeholders. As a result, attacker-controlled input alters the query structure.

Because the REST route does not enforce an authentication or capability check through permission_callback, the endpoint is reachable by anonymous clients. Attackers can issue crafted HTTP requests to the REST path and chain UNION-based or boolean-based payloads to exfiltrate database contents.

Exploitation enables disclosure of records from any table accessible to the plugin's database user, including wp_users password hashes, email addresses, and wp_usermeta session data. Recovered session tokens can facilitate account takeover without a password crack.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The plugin concatenates REST request parameters into a raw query string rather than binding them through prepared statements. Combined with a missing authentication requirement on the route, this produces an unauthenticated SQL injection primitive.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker sends a crafted request to the plugin's REST endpoint with malicious SQL in a vulnerable parameter. No credentials, user interaction, or prior foothold are required. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-89288

Indicators of Compromise

Repeated REST API requests to /wp-json/ paths associated with The Fast Courier plugin containing SQL metacharacters such as UNION, SELECT, SLEEP(, or --.
Anomalous database response times or elevated error rates logged by wpdb after requests to the plugin's endpoints.
Unexpected egress of large response payloads to unknown IP addresses following REST requests to the plugin.

Detection Strategies

Inspect web server access logs for unauthenticated requests to the plugin's REST route containing URL-encoded SQL syntax.
Enable WordPress debug logging and review wpdb errors referencing malformed queries from REST handlers.
Deploy a Web Application Firewall rule that blocks SQL keywords and tautologies on REST paths registered by The Fast Courier.

Monitoring Recommendations

Alert on bursts of 4xx or 5xx responses from /wp-json/ endpoints that correlate with unknown client user agents.
Monitor database query duration anomalies tied to the WordPress application user.
Track outbound connections from the web host immediately after suspicious REST requests to detect data exfiltration.

How to Mitigate CVE-2026-89288

Immediate Actions Required

Update The Fast Courier plugin to version 5.2.4 or later on all WordPress installations.
Rotate WordPress administrator passwords, API keys, and secrets stored in wp_options after patching.
Invalidate all active user sessions by regenerating wp_user_sessions_tokens entries in wp_usermeta.

Patch Information

The vendor addressed the vulnerability in The Fast Courier plugin version 5.2.4. Administrators should upgrade through the WordPress plugin dashboard or by replacing plugin files from the official repository. Review the WPScan Vulnerability Report for advisory details.

Workarounds

Disable and remove The Fast Courier plugin until the patched version can be deployed.
Restrict access to /wp-json/ endpoints registered by the plugin at the reverse proxy or WAF layer.
Enforce IP allow-listing on the WordPress REST API for environments where courier integrations are only consumed by known upstream systems.

bash

# Example nginx snippet to block the vulnerable REST route pending patching
location ~* ^/wp-json/fast-courier/ {
    return 403;
}