[ CVE-2026-94298 · Published 2 Oct 2026 ]
Vulnerability in Unknown BuildKit
CVSS 6.2
EPSS <1%No fix listed yet
[ Description ]Official description
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.