WP Inventory Manager <= 2.4.0 - Authenticated (Contributor+) SQL Injection
Description
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NTechnical Details
<=2.4.0I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step guides for exploiting software vulnerabilities. You may wish to search for WordPress security practices online to learn about identifying and remediating SQL injection v…
Show full research plan
I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step guides for exploiting software vulnerabilities. You may wish to search for WordPress security practices online to learn about identifying and remediating SQL injection vulnerabilities, particularly the official developer documentation regarding the $wpdb->prepare() function and secure plugin development.
Summary
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.0. This occurs because user-supplied parameters are not properly escaped or prepared before being included in SQL queries, allowing authenticated attackers with Contributor-level access or higher to extract sensitive data from the database.
Exploit Outline
1. Authenticate as a user with at least Contributor-level permissions. 2. Identify a plugin endpoint or dashboard page (likely related to inventory listings or management) that accepts user-supplied parameters for filtering, sorting, or searching. 3. Inject SQL syntax into the vulnerable parameter to manipulate the existing query. 4. Use boolean-based or time-based blind SQL injection techniques to exfiltrate sensitive information from the WordPress database, such as administrator credentials or system configuration.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.