CVE-2026-116059

Not scored yetLast modified Nov 13, 2026

Description

The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1160607.3A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/addCVE-2026-1160617.3A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opilCVE-2026-1160627.3A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fiCVE-2026-1160634.7A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipCVE-2026-1160666.8Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers toCVE-2026-1160678.2Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that letCVE-2026-1160688.8Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenCVE-2026-1160696.5NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server CVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wiCVE-2026-1160706.5Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attaCVE-2026-1160715.9rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key iCVE-2026-1160725.4Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an att
CVE-2026-116059: Unscored | Vulnix