CVE-2026-89288

The Fast Courier WordPress plugin, versions 5.0.0 through 5.2.3 , is vulnerable to unauthenticated SQL injection . The flaw exists because the plugin fails to sanitize and escape values provided via the 'wp_order_id' parameter on an unauthenticated REST route. An unauthenticated attacker can expl...