Proof-of-concept exploits are now publicly accessible for three well-known WordPress plugins that have high-severity or serious SQL injection vulnerabilities and tens of thousands of active installations.
A website security problem called SQL injection enables attackers to enter data into form fields or through URLs that alter valid database queries so that they produce different results or change a database.
If a website’s code contains a SQL injection vulnerability, an attacker may be able to change or remove data from a site, insert malicious scripts, or even take complete control of the website.
Joshua Martinelle, a security researcher with Tenable, found the three vulnerable plugins and responsibly reported them to WordPress on December 19, 2022. (PoCs).
All issues have been resolved, and individuals using the most recent version are no longer at risk. The plugin writers published security upgrades to address the flaws in the days or weeks that followed.
A membership and subscriptions management tool called “Paid Memberships Pro,” which is utilized by more than 100,000 websites, was discovered to be the first plugin to be vulnerable to SQL injection.
