CVE-2026-16949

The Term Pages WordPress plugin (versions before 2.0.0 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the improper sanitization and escaping of a parameter used in a SQL statement, specifically identified in the tp_lookup functionality. This flaw allows unauthentica...