Description

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on multisite installations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-16T06:16:53.003Z",
  "pubdate": "2026-08-16T06:16:53.003Z",
  "executiveSummary": "The User Login History plugin for WordPress is susceptible to an SQL Injection vulnerability affecting all versions up to, and including, 2.1.7.\nThe vulnerability resides in the 'blog_id' parameter, which fails to adequately sanitize user-supplied input and lacks proper query parameterization before executing database operations.\nSuccessful exploitation of this security flaw allows authenticated attackers possessing Administrator-level privileges or higher to manipulate existing SQL queries.\nThe primary impact of this vulnerability involves unauthorized database access, enabling malicious actors to extract sensitive information stored within the underlying database architecture.\nExploitation is strictly limited to WordPress multisite installations, as single-site configurations do not process the vulnerable 'blog_id' parameter in the same operational context.\nThe risk implication is critical for affected multisite environments because administrative users can abuse their elevated privileges to execute arbitrary SQL commands, potentially compromising the confidentiality and integrity of the entire multisite network database.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and a complete lack of query preparation regarding the 'blog_id' parameter within the User Login History plugin.\nThe vulnerable component processes the user-supplied 'blog_id' parameter directly within database query construction, failing to utilize secure database abstraction methods or proper escaping mechanisms such as prepared statements.\nThis vulnerability affects all versions of the User Login History plugin up to, and including, 2.1.7.\nThe attack vector requires specific prerequisites, notably an authenticated session with Administrator-level access or above on a WordPress multisite installation.\nThe attack flow proceeds as follows: 1) The authenticated attacker crafts a malicious HTTP request targeting the functionality utilizing the 'blog_id' parameter. 2) The attacker injects malicious SQL syntax payloads into the 'blog_id' parameter. 3) The plugin ingests the unsanitized input and concatenates it directly into the existing SQL query string without adequate preparation or parameter binding. 4) The database management system executes the resulting concatenated query, interpreting the injected SQL commands as part of the original application logic. 5) The injected SQL commands manipulate the execution flow, allowing the attacker to extract sensitive data from the database through techniques such as UNION-based queries or error-based extraction.\nPost-exploitation impact includes unauthorized data exfiltration, exposure of sensitive configuration details, potential credential harvesting from user tables, and broader compromise of the database integrity associated with the WordPress multisite network."
}