CVE-2026-12983

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2026-08-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1369f95a-4ad3-4b0e-a87f-da88d200685e/

References

• CVE Record
• NVD entry

Related

• CVE-2026-12982
• CVE-2026-12987
• CVE-2026-12981
• CVE-2026-12988
• CVE-2026-12979
• CVE-2026-13001