Description

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-19T06:17:31.307Z",
  "pubdate": "2026-08-19T06:17:31.307Z",
  "executiveSummary": "The Dinatur WordPress plugin through version 1.18 suffers from critical security vulnerabilities involving SQL injection and unauthorized database table truncation.\nThe vulnerability types encompass SQL Injection (SQLi) and broken access control leading to data destruction.\nThe affected product is the Dinatur WordPress plugin through version 1.18.\nThe risk implications are severe, potentially leading to complete compromise of the underlying database confidentiality, integrity, and availability, including unauthorized data extraction and total data loss of plugin-specific tables.\nAttacker capabilities include unauthenticated remote exploitation, allowing anonymous threat actors to execute arbitrary SQL queries and truncate database tables without requiring any privileges.\nExploitation requirements are minimal, as the vulnerable handler processes unauthenticated requests directly over the network without input sanitization, escaping, or authorization checks.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation, sanitization, and escaping mechanisms within the Dinatur WordPress plugin through version 1.18. User-supplied input is directly concatenated or interpolated into a SQL query executed against the database.\nAdditionally, the same request handler performs a database table truncation operation without executing any authorization or capability checks, such as verifying user roles or nonces.\nThe vulnerable component is the request handler responsible for processing specific plugin actions within the Dinatur WordPress plugin through version 1.18.\nAuthentication requirements are nonexistent; the attack vector is completely unauthenticated, permitting any remote network visitor to interact with the vulnerable handler.\nPrivilege requirements are absent, as anonymous users can invoke the functionality.\nNetwork exposure is public, assuming the WordPress instance is accessible via the internet.\nThe attack flow begins when an unauthenticated attacker sends a specially crafted HTTP request to the vulnerable endpoint of the Dinatur WordPress plugin.\nUpon receiving the request, the insecure handler fails to validate or sanitize the incoming parameters.\nIn the context of the SQL injection vector, the unsanitized input is directly integrated into the database query execution flow, allowing the attacker to manipulate the query structure, bypass application logic, extract sensitive database contents, or modify records depending on the database management system configuration.\nIn the context of the table truncation vector, the handler immediately executes a database table truncation command without verifying if the requesting entity possesses administrative privileges or valid session tokens.\nPost-exploitation impact includes unauthorized data exfiltration, disclosure of sensitive information stored in the database, and catastrophic data destruction resulting from the complete wiping of the Dinatur WordPress plugin data."
}