TaxoPress <= 3.44.0 - Authenticated (Editor+) SQL Injection
Description
The TaxoPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.44.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v3.45.0
Source Code
WordPress.org SVNb`, it's `IN ('a','b')`. Our payload effectively escapes the `IN` list and the single quote. One thing: `sanitize_text_field`? The code in `taxopress_terms_clauses` does NOT call any sanitization on `$cpt`! ```php foreach ($args['post_types'] as $cpt) { $post_types[] = "…
Show full research plan
b, it's IN ('a','b'). Our payload effectively escapes the IN` list and the single quote.
One thing: `sanitize_text_field`?
The code in `taxopress_terms_clauses` does NOT call any sanitization on `$cpt`!
```php
foreach ($args['post_types'] as $cpt) {
$post_types[] = "'" . $cpt . "'";
}
```
This is raw concatenation. Perfect.
The CVSS 4.9 Vector: `AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`.
This confirms:
- `PR:H`: High privilege (Editor/Admin).
- `C:H`: High Confidentiality (Data extraction).
- `I:N`: No Integrity (No modification).
- `A:N`: No Availability (No DoS, though SLEEP is a temporary DoS).
Wait, if it was `A:H`, it would be higher. SQLi usually allows `C:H/I:H/A:H`, but researchers often limit it to `C:H` for SQLi that only allows `SELECT`.
One more check: `SimpleTags_Terms::taxopress_terms_clauses`
Does it check `is_admin()`? No, it
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.