CVE-2026-89235 in Testimonials by BestWebSoft Plugin
Summary
by MITRE • 10/09/2026
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within the Testimonials plugin for WordPress, specifically affecting versions up to 1.0.8, represents a critical failure in input validation and data handling practices that directly facilitates database manipulation. This flaw is rooted in the application's inability to properly sanitize or escape user-supplied parameters before they are incorporated into Structured Query Language statements executed by the backend database system. In secure software development, any data originating from external sources, such as HTTP requests, must be rigorously validated and escaped to ensure it is treated strictly as data rather than executable code. The absence of these protective measures creates a direct pathway for attackers to inject malicious SQL commands into legitimate queries, fundamentally compromising the integrity and confidentiality of the underlying database infrastructure.
From a technical perspective, this issue classifies under CWE-89, commonly known as SQL Injection, which remains one of the most prevalent and dangerous web application vulnerabilities. The specific mechanism involves an unauthenticated attacker sending crafted requests to the plugin's endpoints where parameters are passed without adequate filtering functions such as prepared statements or database-specific escaping routines like mysql_real_escape_string in legacy contexts or parameterized queries in modern frameworks. By appending additional SQL syntax, an attacker can alter the logic of the original query. This capability allows for a wide range of malicious activities including data exfiltration where sensitive information from other tables is retrieved, modification or deletion of existing records to disrupt service integrity, and potentially achieving remote code execution if the database server configuration permits certain high-privilege operations like writing files to disk using functions such as INTO OUTFILE.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Unlike vulnerabilities that require a logged-in user with specific roles, this flaw can be exploited by any internet-facing visitor without prior authentication credentials. This significantly lowers the barrier for entry, allowing automated scanning tools and opportunistic attackers to target vulnerable instances at scale. The consequences extend beyond simple data theft; successful exploitation can lead to complete compromise of the WordPress installation if combined with other vulnerabilities or misconfigurations. Attackers may use this access to deface websites, install backdoors, pivot into internal networks where the database server resides, or harvest credentials and personal user data stored in the WordPress database, leading to significant reputational damage and potential regulatory penalties under data protection laws such as GDPR or CCPA depending on the jurisdiction and nature of the compromised data.
Mitigation strategies must prioritize immediate remediation through software updates alongside broader security hygiene practices. The primary defense is to upgrade the Testimonials plugin to version 1.0.9 or later, where the developers have implemented proper input sanitization and output escaping mechanisms aligned with WordPress coding standards. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include implementing a Web Application Firewall configured with rulesets specifically designed to detect and block SQL injection patterns in HTTP parameters. Additionally, enforcing principle of least privilege for database accounts used by the web application can limit the damage an attacker might cause even if exploitation succeeds. Regular security audits focusing on input validation across all plugins are essential to prevent recurrence, ensuring that no external data is ever trusted implicitly within query construction logic.