CVE-2026-16061

CVE-2026-16061 is an unauthenticated SQL injection flaw (CWE-89) in the Rest Routes WordPress plugin, affecting all versions through 5.5.5. The plugin takes a value from the URL of one of its public REST routes and passes it into a SQL query without sanitization or validation, so any remote attacker who can reach the site can send a crafted request that injects arbitrary SQL. Because the route is public and exploitation requires no authentication or user interaction, an attacker can read data from the WordPress database; the 8.6 CVSS score reflects high confidentiality impact (e.g., exposure of user credentials, posts, and site options), with no integrity or availability impact scored. Any WordPress site running an affected version of the plugin is exposed directly over the network. As of the latest data there is no known public proof-of-concept, no CISA KEV listing, and EPSS assigns only a 0.3% (18th percentile) probability of exploitation within 30 days, indicating no confirmed in-the-wild exploitation and low near-term risk.

What to do: Update the Rest Routes plugin to the latest patched release as soon as one newer than 5.5.5 is available (no fixed version number was provided in the source data, so check the plugin changelog or WPScan advisory). Until patching, restrict or block public access to the plugin's REST endpoints via WAF rules or server configuration, and review web/REST access logs for requests containing SQL syntax aimed at the affected route. Given the low EPSS score, this can be prioritized alongside routine WordPress plugin updates, but should not be deferred indefinitely since the flaw is trivially triggerable by unauthenticated attackers.