Description

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is reachable without any account because the vulnerable code path is triggered via the user_register hook fired on every successful WooCommerce My Account registration, which requires only a guest-obtainable nonce.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-07T05:18:08.970Z",
  "pubdate": "2026-11-07T05:18:08.970Z",
  "executiveSummary": "The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is susceptible to an unauthenticated SQL Injection (SQLi) vulnerability, identified in all versions up to and including 1.2.14.\nThe vulnerability originates from inadequate input validation and the absence of parameterized queries when processing the 'email' parameter within the registration workflow.\nAn attacker can exploit this flaw to execute arbitrary SQL commands by injecting malicious payloads into the 'email' field during a WooCommerce My Account registration process.\nThis vulnerability is particularly critical as it does not require user authentication, allowing remote, unauthenticated attackers to interact with the database.\nSuccessful exploitation facilitates the unauthorized extraction of sensitive data from the underlying WordPress database, posing a significant risk to site integrity and data confidentiality.\nThe attack vector is inherently linked to the user_register hook, which is triggered automatically upon successful account creation, making the exploit feasible for any guest user capable of reaching the registration endpoint.",
  "technicalDetails": "The vulnerability is a classic SQL Injection (SQLi) flaw caused by the failure to sanitize user-provided input before incorporating it into a database query. Specifically, the 'email' parameter is passed directly into the SQL statement without sufficient escaping or the use of prepared statements (e.g., $wpdb->prepare).\nThe affected component is the integration logic triggered by the user_register hook. Because this hook is executed during the standard WooCommerce registration process, the vulnerable code path becomes reachable whenever a new account is registered. Since WooCommerce registration is typically accessible to public users, the attack surface is globally exposed.\nAn attacker can exploit this by crafting a specially formatted email address containing SQL syntax. When the application processes the registration, the backend query interprets the injected characters as commands rather than data. This manipulation allows for the alteration of the query's logic, enabling an attacker to perform unauthorized operations.\nThe attack flow proceeds as follows: First, the attacker initiates a registration request on the WooCommerce My Account page. Second, the attacker submits a malicious payload within the 'email' field, designed to break out of the intended query context. Third, the SliceWP plugin intercepting the user_register hook processes the malicious string, executing the injected SQL commands against the database.\nThe lack of sanitization allows for UNION-based or blind SQL injection techniques, which can be leveraged to dump table content, retrieve administrative credentials, or access sensitive configuration data. Given the context of the user_register hook, the injection is processed with the privileges of the database user account configured for the WordPress installation.\nBecause the trigger relies on a guest-obtainable nonce during the registration process, there are no meaningful authentication or privilege requirements to inhibit the exploit. Any unauthenticated user capable of submitting the registration form can successfully trigger the vulnerable code path, leading to full database compromise if the application user has sufficient permissions."
}