SQL Injection in wp-post-author Plugin

Executive Summary

This is a SQL injection vulnerability in the WordPress plugin WP Post Author affecting versions before 4.1.0. The issue occurs because the plugin directly inserts user-supplied input into SQL queries without proper sanitization or escaping. Only basic input cleaning is done, which does not prevent SQL injection. Attackers can exploit this by injecting malicious SQL code through parameters like order_by, order, search, per_page, and page.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in wp-post-author, check if the plugin version is below 4.1.0. Inspect network traffic for suspicious SQL-like queries in parameters such as order_by, order, search, per_page, or page. Use tools like SQLmap to test for SQL injection by sending crafted inputs to these parameters.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to extract sensitive data, such as an administrator's password hash, from the database. They could also manipulate or delete data, depending on their goals. The attack requires high privileges but no user interaction, making it dangerous if the attacker gains access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if such breaches occur due to unpatched vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the wp-post-author plugin to version 4.1.0 or later. If upgrading is not possible, disable the plugin temporarily until an update is applied. Review and restrict access to the vulnerable REST endpoints to minimize exposure.

Useful 0 Not Useful 0