Vulnerability · Published Sep 28, 2026 · Assigned by WPScan

CVE-2026-93000SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search

Medium 6.8

In plain English

A medium-severity SQL injection in SPS-Suite from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.

Affected products (as reported)

Vendor	Product	Versions
Unknown	SPS-Suite	0 – through 1.4.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/a6f90424-46df-4f44-9491-76c75b5ab5eb/ exploit, vdb-entry, technical-description