Description

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-11-06T06:16:39.597Z",
  "pubdate": "2026-11-06T06:16:39.597Z",
  "executiveSummary": "The Mail Mage WordPress plugin, in versions up to and including 0.0.25, contains a critical SQL injection (SQLi) vulnerability. This security flaw stems from the improper sanitization and escaping of user-supplied input before it is incorporated into database queries. The vulnerability allows unauthenticated, remote attackers to execute arbitrary SQL commands against the underlying database. Successful exploitation of this flaw can result in unauthorized access to sensitive information, potential modification or deletion of database records, and in some configurations, complete compromise of the WordPress installation. Given that the vulnerability requires no authentication, it presents a significant risk to site integrity and confidentiality, as it can be exploited by any remote actor with network access to the target web server.",
  "technicalDetails": "The vulnerability resides within the database abstraction layer of the Mail Mage plugin. Specifically, the plugin fails to utilize WordPress-native sanitization functions such as 'sanitize_text_field()' or escaping functions like '$wpdb->prepare()' when processing user-provided parameters intended for SQL query construction. This oversight allows an attacker to inject malicious SQL syntax into input fields processed by the plugin, effectively breaking out of the intended query structure.\nThe root cause is the direct concatenation of unvalidated user input into dynamic SQL queries. When a request is sent to the vulnerable endpoint, the plugin improperly handles the input, treating it as executable SQL code rather than literal data. Because the plugin does not implement adequate input validation or parameterization, the attacker can manipulate the query logic via crafted HTTP requests. This vulnerability is accessible over the network without any requirement for prior authentication or administrative privileges.\nThe attack flow begins when an attacker identifies a vulnerable input vector within the plugin. The attacker submits a specially crafted HTTP request containing SQL injection payloads, such as UNION-based or time-based blind SQL injection strings. Upon processing the request, the plugin passes this malicious string into a backend database query. The database interpreter executes the injected commands, granting the attacker the ability to perform operations such as extracting administrator credentials, altering user roles, or dumping the entire contents of the database.\nPost-exploitation impact is severe. An attacker can leverage this access to bypass authentication mechanisms, elevate their privileges, or potentially execute arbitrary code if the database environment allows (e.g., through 'INTO OUTFILE' or similar commands if permissions are misconfigured). Furthermore, the lack of input sanitization enables attackers to retrieve sensitive application configuration data, including WordPress site keys and database connection strings, facilitating deeper server-side compromise."
}