CVE-2026-116059
LetsRecover <= 1.2.0 - Unauthenticated SQL Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.
| Vendor | unknown |
| Product | letsrecover |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown letsrecover
Be the first to know when new unknown vulnerabilities affecting unknown letsrecover are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / LetsRecover
0 ≤ 1.2.0
References
Credits
Naoki Kawahigashi WPScan