CVE-2026-116059highCWE-89

CVE-2026-116059: high-severity vulnerability in LetsRecover

LetsRecover <= 1.2.0 - Unauthenticated SQL Injection

Published

Follow this CVE+ Monitor LetsRecover

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6
The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · LetsRecover
Related CVEs — LetsRecover

In the same product, most dangerous first.

CVE-2022-4357CRITICALLetsRecover < 1.2.0 - Unauthenticated SQLiEPSS 1.1%CVE-2022-4355HIGHLetsRecover < 1.2.0 - Admin+ SQLiEPSS 1.0%CVE-2022-4356HIGHLetsRecover < 1.2.0 - Admin+ SQLiEPSS 1.0%