Description

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T05:17:09.103Z",
  "pubdate": "2026-09-01T05:17:09.103Z",
  "executiveSummary": "The Persistent Login plugin for WordPress contains a critical SQL injection vulnerability identified in versions up to and including 3.1.0.\nThe flaw resides within the processing of the 'wppl_device_id' cookie, which fails to implement necessary input sanitization or parameterized queries.\nThis vulnerability allows authenticated users with subscriber-level privileges or higher to execute arbitrary SQL commands against the WordPress database, provided the plugin's 'Login History' feature is enabled.\nThe primary risk involves the unauthorized extraction of sensitive information, such as user credentials, session tokens, or site configurations, from the backend database.\nSuccessful exploitation allows an attacker to manipulate existing SQL queries by appending malicious statements, potentially leading to unauthorized data disclosure or database integrity compromise.\nThe attack vector is limited to authenticated actors who can manipulate their own browser cookies; however, the impact is significant due to the potential for privilege escalation or full data exposure.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw stemming from improper handling of user-supplied data within the database interaction layer of the Persistent Login plugin.\nSpecifically, the plugin processes the 'wppl_device_id' cookie without adequate escaping or the use of prepared statements (e.g., $wpdb->prepare).\nWhen the 'Login History' feature is active, the plugin retrieves the value of the 'wppl_device_id' cookie and directly interpolates this input into a SQL query string.\nBecause the input is not sanitized, an attacker can supply a specially crafted cookie value that breaks out of the intended query structure, allowing for the injection of secondary SQL commands.\nThe exploitation flow begins when an authenticated user sends an HTTP request to the web server with a malicious 'wppl_device_id' cookie.\nThe WordPress application backend, upon receiving this request, retrieves the cookie and passes it to the vulnerable code path responsible for updating or checking the Login History database table.\nAn attacker can use techniques such as UNION-based SQL injection to append additional SELECT statements to the original query, enabling the retrieval of data from other tables within the WordPress database schema.\nSince the database driver executes the concatenated query, the injected commands run with the privileges of the database user configured for the WordPress installation.\nThe vulnerability is restricted to environments where the 'Login History' functionality is explicitly enabled, as the code path containing the flaw is conditionally executed based on this setting.\nAffected versions include all releases up to and including 3.1.0.\nPost-exploitation impact is severe, as the ability to extract data from the database allows an attacker to gain access to password hashes, user metadata, and other sensitive site information, effectively bypassing internal access controls.\nThe lack of prepared statements ensures that the application is unable to distinguish between genuine data and malicious SQL instructions provided via the cookie parameter."
}