Description

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:17:02.810Z",
  "pubdate": "2026-08-13T14:17:02.810Z",
  "executiveSummary": "A Subscriber SQL Injection vulnerability has been identified in WPJAM Basic <= 7.0.1 versions.\nThis security flaw involves improper neutralization of special elements used in an SQL command, commonly known as SQL Injection.\nThe vulnerability allows authenticated attackers with low-privileged subscriber accounts to inject malicious SQL payloads into database queries executed by the application.\nSuccessful exploitation of this flaw can lead to unauthorized access to sensitive database contents, including user credentials and confidential application data, potential data modification or deletion, and in severe scenarios, complete compromise of the underlying database management system.\nThe risk implication is critical due to the potential exposure of sensitive application data and the ability to manipulate database operations despite low initial privilege requirements.\nAttacker capabilities include executing arbitrary SQL commands via the vulnerable component.\nExploitation requires authenticated access with subscriber-level privileges within the affected WordPress environment.",
  "technicalDetails": "The vulnerability resides in the WPJAM Basic plugin, affecting all versions up to and including 7.0.1.\nThe root cause of the issue is the failure of the application to properly sanitize and validate user-supplied input before incorporating it directly into database queries.\nBecause input handling lacks adequate parameterization or escaping mechanisms, input controlled by users with subscriber privileges is interpreted as executable SQL syntax by the database backend.\nThe attack flow begins when an authenticated user possessing subscriber privileges interacts with a vulnerable endpoint or functionality exposed by the WPJAM Basic plugin.\nThe attacker crafts a malicious HTTP request containing a specially constructed payload designed to manipulate the intended SQL query logic.\nUpon receiving the request, the vulnerable component processes the input and concatenates or interpolates it directly into the database query without sufficient neutralization.\nThe database server then executes the modified query, returning unintended result sets or performing unauthorized data manipulation based on the injected payload.\nNetwork exposure is present wherever the WordPress instance is accessible, though exploitation specifically mandates authenticated subscriber-level privileges.\nNo complex exploitation vectors are required beyond standard HTTP request manipulation once valid subscriber credentials are acquired.\nPost-exploitation impact encompasses unauthorized data exfiltration, enumeration of database schemas, potential bypass of authentication or access controls, and degradation of data integrity within the WordPress database."
}