CVE-2026-39479

The OttoKit plugin for WordPress contains a security flaw in versions up to 1.1.20, allowing malicious users with elevated privileges to inject unauthorized SQL code into database queries. This occurs because user input is not properly sanitized before being incorporated into existing SQL statements. As a result, attackers can potentially extract confidential data from the database.

Based on public CVE data (MITRE/NVD).