WordPress Plug-in Vulnerability Let Hackers Inject Malicious SQL Queries
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
A critical vulnerability in GamiPress, a popular WordPress plugin used for gamification and rewards systems on websites.
The high-impact flaw, categorized as CVE-2024-13496 with a CVSS 3.1 score of 7.5, allowed unauthenticated attackers to inject malicious SQL queries that could potentially compromise entire WordPress installations.
The vulnerability, which affected all GamiPress versions up to 7.3.1, was finally patched in version 7.3.2, released on March 18, 2025.
GamiPress Plugin: Unauthenticated SQL Injection Flaw
During an offsite security assessment, security researcher Abrahack identified the vulnerability while examining GamiPress plugin version 7.2.1.
The vulnerability stemmed from improper input validation in the plugin’s log retrieval functionality, specifically in the gamipress_get_logs AJAX endpoint, which allows unauthenticated access through the WordPress hook wp_ajax_nopriv_{$action}.
This type of SQL injection vulnerability is hazardous because it requires no authentication to exploit. An attacker could potentially extract sensitive information from the database or even take control of the website.
The plugin’s vulnerability existed in handling the orderby parameter in database queries. The vulnerable code in the plugin can be seen here:
While the code attempted to sanitize inputs using sanitize_text_field(), the vulnerability occurred further down the execution chain in the CT_Query class, where the orderby parameter was unsafely incorporated into SQL queries:
This code eventually led to the construction of an SQL query where the attacker-controlled input was incorporated:
The summary of the vulnerability is given below:
Risk Factors Details Affected ProductsGamiPress WordPress plugin, versions ≤ 7.2.1ImpactSQL injection, Extracting sensitive information from the databaseExploit PrerequisitesNo authentication required; ability to send HTTP requests with manipulated ‘orderby’ parameterCVSS 3.1 Score7.5 (High)
Patch Implementation
The developers of GamiPress addressed the vulnerability by implementing a whitelist approach for the orderby parameter, restricting it to a predefined list of valid columns in the database table.
This approach effectively prevents attackers from injecting malicious SQL commands.Cybersecurity experts strongly urge WordPress website administrators using the GamiPress plugin to update to version 7.3.2 or later immediately. Additionally, administrators should:
This vulnerability reminds us of the importance of regular security audits and prompt patching of content management systems and their extensions to maintain website security integrity.
#Cyber_Security #Cyber_Security_News #SQL #Vulnerability #Wordpress #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
WordPress Plug-in Vulnerability Let Hackers Inject Malicious SQL Queries
Author: Guru BaranA critical vulnerability in GamiPress, a popular WordPress plugin used for gamification and rewards systems on websites.
The high-impact flaw, categorized as CVE-2024-13496 with a CVSS 3.1 score of 7.5, allowed unauthenticated attackers to inject malicious SQL queries that could potentially compromise entire WordPress installations.
The vulnerability, which affected all GamiPress versions up to 7.3.1, was finally patched in version 7.3.2, released on March 18, 2025.
GamiPress Plugin: Unauthenticated SQL Injection Flaw
During an offsite security assessment, security researcher Abrahack identified the vulnerability while examining GamiPress plugin version 7.2.1.
The vulnerability stemmed from improper input validation in the plugin’s log retrieval functionality, specifically in the gamipress_get_logs AJAX endpoint, which allows unauthenticated access through the WordPress hook wp_ajax_nopriv_{$action}.
This type of SQL injection vulnerability is hazardous because it requires no authentication to exploit. An attacker could potentially extract sensitive information from the database or even take control of the website.
The plugin’s vulnerability existed in handling the orderby parameter in database queries. The vulnerable code in the plugin can be seen here:
While the code attempted to sanitize inputs using sanitize_text_field(), the vulnerability occurred further down the execution chain in the CT_Query class, where the orderby parameter was unsafely incorporated into SQL queries:
This code eventually led to the construction of an SQL query where the attacker-controlled input was incorporated:
The summary of the vulnerability is given below:
Risk Factors Details Affected ProductsGamiPress WordPress plugin, versions ≤ 7.2.1ImpactSQL injection, Extracting sensitive information from the databaseExploit PrerequisitesNo authentication required; ability to send HTTP requests with manipulated ‘orderby’ parameterCVSS 3.1 Score7.5 (High)
Patch Implementation
The developers of GamiPress addressed the vulnerability by implementing a whitelist approach for the orderby parameter, restricting it to a predefined list of valid columns in the database table.
This approach effectively prevents attackers from injecting malicious SQL commands.Cybersecurity experts strongly urge WordPress website administrators using the GamiPress plugin to update to version 7.3.2 or later immediately. Additionally, administrators should:
- Review server logs for any unusual activity
- Implement web application firewalls for additional protection
- Follow security best practices for WordPress installations
This vulnerability reminds us of the importance of regular security audits and prompt patching of content management systems and their extensions to maintain website security integrity.
#Cyber_Security #Cyber_Security_News #SQL #Vulnerability #Wordpress #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
