Description

Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-27T10:16:35.677Z",
  "pubdate": "2026-08-27T10:16:35.677Z",
  "executiveSummary": "The Kadence Shop Kit plugin for WordPress, specifically in versions 3.0.6 and below, is susceptible to an authenticated SQL injection vulnerability.\nThis vulnerability stems from improper sanitization of user-supplied input before being used in database queries.\nAn attacker with subscriber-level privileges or higher can exploit this flaw to execute arbitrary SQL commands against the WordPress database.\nSuccessful exploitation allows unauthorized access to sensitive information, potential modification or deletion of data, and under certain configurations, full administrative takeover of the WordPress instance.\nThe vulnerability poses a high risk to the confidentiality, integrity, and availability of the affected system.\nThis flaw can be exploited remotely by authenticated users without requiring specialized infrastructure beyond standard network access to the target site.",
  "technicalDetails": "The vulnerability exists due to insufficient input validation and sanitization of user-controlled parameters within the Kadence Shop Kit plugin. The application fails to properly employ parameterized queries or escaping functions when interacting with the database, allowing for the injection of malicious SQL syntax into existing database operations.\nThe attack flow begins with an authenticated user, such as a subscriber, submitting a crafted request containing malicious SQL payloads to an endpoint handled by the vulnerable component of the plugin. Because the input is not adequately validated before being passed into a SQL query, the database engine interprets the attacker-supplied input as part of the command rather than as literal data.\nBy manipulating the SQL query, an attacker can bypass authorization checks, extract data from tables (e.g., wp_users, wp_options), or modify data within the database. The impact is significant as it allows the attacker to read protected data, escalate privileges, or disrupt the application's functionality.\nThe vulnerable code path involves the insecure handling of inputs that are subsequently concatenated into database queries. Since the plugin does not utilize the WordPress $wpdb->prepare() method effectively or similar mechanisms for all relevant inputs, it fails to enforce safe interaction between the application layer and the database layer.\nExploitation does not require elevated privileges beyond a standard subscriber account, making it a viable target for attackers who have successfully registered an account on the site. The payload can be delivered via standard HTTP request methods such as GET or POST, depending on the specific endpoint being targeted within the plugin.\nPost-exploitation, the impact can escalate from unauthorized data disclosure to full site compromise if, for instance, the attacker succeeds in modifying the password of an administrative user or inserting a malicious administrator account into the wp_users table. The attack is restricted to those who can authenticate to the site, but given the nature of the vulnerability, the bar for entry is low for any user capable of registering an account."
}