CVE-2026-89288: Unknown Fast Courier

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Affected products

• Unknown Fast Courier: from 5.0.0, before 5.2.4 (fixed in 5.2.4)

Published 2026-10-14. Last modified 2026-10-15.