Description

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-06T15:17:16.480Z",
  "pubdate": "2026-08-06T15:17:16.480Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the Qode Tours plugin for WordPress, specifically affecting versions 3.1.3.1 and prior. This security flaw arises from improper sanitization and validation of user-supplied input before it is concatenated into database queries. Remote, unauthenticated threat actors can exploit this vulnerability by sending specially crafted HTTP requests containing malicious SQL payloads to the target web application.\nSuccessful exploitation of this vulnerability grants an attacker direct interaction with the underlying database management system. This leads to severe security impacts, including unauthorized data exfiltration, exposure of sensitive user credentials, potential modification or deletion of database records, and in certain database configurations, complete system compromise or remote code execution. The risk implications are critical due to the lack of authentication and privilege requirements, allowing any external entity on the network to compromise the confidentiality, integrity, and availability of the affected system without prior interaction or administrative access.",
  "technicalDetails": "The vulnerability is classified as an SQL Injection (SQLi), stemming from the insecure handling of dynamic database queries within the Qode Tours plugin. The root cause lies in the application's failure to adequately parameterize queries or sanitize input parameters processed by the plugin's backend logic. Specifically, user-supplied data transmitted via HTTP GET or POST parameters is ingested by vulnerable PHP functions and directly concatenated into SQL statement strings executed against the database.\nThe attack vector involves network exposure over the HTTP/HTTPS protocols. Because the vulnerability is unauthenticated, the exploitation requirements are minimal; an attacker does not need valid user credentials or session tokens to interact with the vulnerable endpoint. The attack flow initiates when an external adversary crafts a malicious HTTP request embedding SQL syntax into the vulnerable parameter. Upon receipt, the PHP application processes the input and forwards the unsanitized string to the database layer.\nDuring execution, the database interpreter evaluates the malicious input as executable SQL commands rather than inert string literals. This payload behavior allows the attacker to manipulate the original query logic, bypass application logic controls, and execute arbitrary SQL commands. Depending on the database user permissions associated with the WordPress installation, post-exploitation impact ranges from retrieving sensitive tables containing administrator hashes and user metadata, to extracting configuration data, and potentially leveraging stacked queries or file read/write operations if the database server configuration permits."
}