CVE-2026-99999
Critical Severity
SQL Injection in Custom Ajax Plugin
Vulnerability Type: SQL Injection (SQLi)
Published: Aug 2026
Remediation Action
Upgrade the custom plugin to version 1.2.1, or sanitize the AJAX ID input parameter using absint() or prepare() database statements.
This is the body of the advisory. The vulnerability resides in wp-content/plugins/custom-ajax/custom-ajax.php where user input is directly concatenated into a SQL query.