Description

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-29T06:17:00.247Z",
  "pubdate": "2026-08-29T06:17:00.247Z",
  "executiveSummary": "The Rest Routes WordPress plugin, in versions up to 5.5.5, is susceptible to an unauthenticated SQL injection vulnerability.\nThis flaw originates from the improper sanitization and validation of user-supplied data provided via a public REST API route before incorporating the input into database queries.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the WordPress database.\nGiven the severity and the lack of authentication required, this vulnerability poses a significant risk to the integrity and confidentiality of the affected WordPress site.",
  "technicalDetails": "The vulnerability resides within the plugin's REST API endpoint handling logic. Specifically, the plugin accepts a parameter directly from the incoming URL request without applying sufficient sanitization or validation routines.\nWhen a request is made to the affected public REST route, the plugin extracts the attacker-controlled input and constructs a SQL query using string concatenation or improper parameterization. By injecting malicious SQL syntax into this input parameter, an attacker can manipulate the query structure.\nThe attack vector involves crafting a HTTP request targeting the vulnerable REST API endpoint. An attacker can append SQL injection payloads to the target parameter. Because the input is not sanitized, the database management system executes the injected commands as part of the intended query.\nThe lack of authentication requirements means that any remote user can trigger this vulnerability, making it highly exploitable over a network. The attack flow proceeds as follows: First, the attacker identifies the exposed REST route. Second, they craft a malicious URL parameter containing SQL syntax designed to bypass intended query logic. Third, the WordPress server receives the request and, due to the lack of validation, executes the modified query against the database.\nThe impact of this vulnerability is severe. Successful exploitation could allow an attacker to bypass authentication mechanisms, exfiltrate sensitive data from the database, alter plugin configurations, or potentially execute administrative actions if the database user has sufficient privileges.\nThe vulnerable component is the input handling mechanism of the plugin's REST API implementation. The issue is persistent across all versions of the Rest Routes plugin through 5.5.5."
}