Description

Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-24T12:16:51.607Z",
  "pubdate": "2026-08-24T12:16:51.607Z",
  "executiveSummary": "A Subscriber-level SQL Injection vulnerability has been identified in WP Project Manager Pro versions <= 4.0.1. This security flaw arises from improper sanitization and neutralization of user-supplied input before being concatenated into database queries within the application's codebase.\nThe vulnerability allows authenticated users with minimal privileges, specifically the Subscriber role, to inject malicious SQL payloads directly into database operations. Successful exploitation of this flaw can lead to unauthorized database access, sensitive data extraction including user credentials and proprietary project data, and potential remote database manipulation.\nThe risk implications are critical, as an attacker with low-privilege access can compromise the confidentiality, integrity, and availability of the underlying database management system. Exploitation requires the attacker to authenticate as a Subscriber within the WordPress instance and interact with vulnerable query parameters handled by the WP Project Manager Pro plugin.\nOrganizations utilizing the affected software are at high risk if public user registration is enabled or if untrusted users are granted Subscriber privileges. Remediation requires updating the WP Project Manager Pro plugin beyond the vulnerable version threshold or applying official vendor patches as soon as they become available.",
  "technicalDetails": "The vulnerability exists within the database query construction logic of WP Project Manager Pro versions <= 4.0.1. The root cause is the direct incorporation of unsanitized parameters into SQL statements without utilizing parameterized queries, prepared statements, or proper input escaping mechanisms provided by the WordPress database abstraction layer ($wpdb).\nAuthentication and privilege requirements involve an attacker possessing a valid user account with Subscriber-level privileges on the target WordPress installation. Network exposure is standard for web applications, requiring HTTP or HTTPS access to the WordPress frontend or backend endpoints exposed by the plugin.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies an endpoint or AJAX action managed by WP Project Manager Pro that accepts user input intended for database filtering, sorting, or retrieval. Second, the attacker crafts a malicious HTTP request containing a SQL injection payload appended to the vulnerable parameter. Third, the plugin processes the request and concatenates the tainted input directly into a dynamic SQL query string executed against the database via the $wpdb interface.\nPayload behavior manifests as the database server interprets the injected SQL commands as part of the application's legitimate query logic. This allows the attacker to manipulate the query structure, bypass logical conditions, and execute arbitrary SQL commands. Depending on the database configuration and database user permissions, the attacker can leverage techniques such as UNION-based SQL injection, error-based extraction, or boolean-blind inference to retrieve unauthorized data.\nPost-exploitation impact includes the extraction of sensitive information stored in the WordPress database, such as password hashes, user metadata, private posts, and confidential project management data managed by the plugin. In scenarios where database user privileges are overly permissive, further system compromise or lateral movement may become feasible."
}