Description

Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-06T09:17:45.883Z",
  "pubdate": "2026-10-06T09:17:45.883Z",
  "executiveSummary": "The Booknetic WordPress plugin, in versions 4.8.5 and below, contains a critical SQL Injection (SQLi) vulnerability.\nThis vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands directly against the underlying database.\nThe flaw stems from insufficient input sanitization and improper handling of user-supplied data before incorporating it into database queries.\nSuccessful exploitation enables unauthorized parties to bypass authentication mechanisms, gain administrative access, exfiltrate sensitive data, modify database contents, or potentially achieve remote code execution if database permissions are overly broad.\nGiven that no authentication is required to trigger this vulnerability, the risk is classified as critical, as it allows for trivial exploitation via public network access.\nOrganizations relying on Booknetic are at significant risk of total site compromise and data breach unless immediate remedial actions are taken.",
  "technicalDetails": "The vulnerability resides within the Booknetic plugin's request handling logic, where user-supplied input is processed without adequate validation or the use of prepared statements.\nThe root cause is the unsafe concatenation of input parameters into database query strings, allowing an attacker to escape the intended query context and append malicious SQL directives.\nAn unauthenticated attacker can target the vulnerable endpoint by crafting a specially formulated HTTP request containing SQL payloads within the parameter fields. When the plugin processes these parameters, the database driver executes the injected SQL commands with the privileges assigned to the database user configured for the WordPress instance.\nThe attack flow typically involves identifying the vulnerable plugin endpoint, mapping the affected parameters, and iteratively refining a payload to perform operations such as blind or time-based extraction of the database schema, table contents, and administrative credentials.\nBecause the input is not sanitized or parameterized, the attacker can leverage standard SQL syntax to manipulate query logic, such as using UNION-based injection to extract data from auxiliary tables or injecting stacked queries to modify data integrity.\nThis vulnerability is particularly dangerous as it circumvents all WordPress-native security barriers, including authentication checks and permission controls, by interacting directly with the persistence layer of the application.\nAffected versions include all iterations up to and including 4.8.5. The impact of successful exploitation extends to the complete compromise of the WordPress database, potentially leading to the dumping of user tables (passwords, email addresses), modification of plugin configurations to redirect traffic, or the injection of malicious administrative accounts to establish persistence. In environments where the database user has elevated system privileges (such as FILE permissions), the vulnerability could potentially be escalated to facilitate server-side file operations."
}