WordPress Term Pages plugin < 2.0.0 - Unauthenticated SQL Injection via tp_lookup vulnerability

Unauthenticated SQL Injection via tplookup vulnerability discovered by João Ramos Maciel in WordPress Plugin Term Pages versions 2.0.0...

CVE-2026-16949

CVE-2026-16949 affects the Term Pages WordPress plugin prior to 2.0.0. The vulnerability arises from not properly sanitising and escaping a parameter before constructing a SQL statement, enabling unauthenticated SQL injection. Exploit details and a formal fix/patch version are not provided in the...