Rest Routes – Custom Endpoints for WordPress REST API, CVE-2026-16061

CVE, Research URL: CVE-2026-16061
Home page URL: Security reports for Rest Routes – Custom Endpoints for WordPress REST API
Application: Rest Routes – Custom Endpoints for WordPress REST API
Published on: Aug 29, 2026
Research Description: The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Affected versions: max 5.5.5.
Status: vulnerable