Ghostwire

CVE-2026-4935: The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before...

CRITICAL CVSS 9.5

Published: May 8, 2026 | Last Modified: May 8, 2026

Description

The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References

www.tenable.com/cve/CVE-2026-4935
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-4935
wpscan.com/vulnerability/54bc1bf4-1033-49e2-aff9-a14c834c35bd/