Description

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-20T12:16:33.307Z",
  "pubdate": "2026-08-20T12:16:33.307Z",
  "executiveSummary": "This security analysis details a SQL Injection vulnerability affecting the Persistent Login plugin for WordPress in versions <= 3.1.0.\nThe vulnerability allows authenticated users with low-privilege Subscriber accounts to manipulate database queries through unsanitized input vectors.\nSuccessful exploitation of this flaw can lead to unauthorized database access, potential data exfiltration, information disclosure, and full compromise of the underlying WordPress installation depending on database user privileges.\nThe attack capability requires authenticated access at the Subscriber privilege level, lowering the barrier for exploitation by malicious internal users or compromised accounts.\nRisk implications are severe, as SQL injection directly threatens the confidentiality, integrity, and availability of the affected application and its persistent session data storage.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and improper parameterization within database query constructions handled by the Persistent Login plugin <= 3.1.0.\nSpecifically, user-supplied input intended for persistent session management or tracking functions is concatenated directly into SQL statements without adequate escaping or the use of prepared statements.\nAttackers authenticated with Subscriber-level privileges can supply crafted payloads targeting vulnerable endpoints or query parameters processed by the plugin.\nThe attack flow proceeds as follows: First, the authenticated user issues an HTTP request containing a malicious SQL payload injected into an exposed input vector handled by the plugin's backend logic.\nSecond, the vulnerable component parses the request and improperly integrates the tainted input into a database query string.\nThird, the database management system executes the resulting query, interpreting the attacker's input as executable SQL commands rather than literal data.\nNetwork exposure is inherent to web applications running WordPress, as attackers can reach the vulnerable endpoints over standard HTTP/HTTPS protocols assuming they possess valid Subscriber credentials.\nPost-exploitation impact includes the extraction of sensitive database contents such as user password hashes, personal identifiable information, and site configuration data, alongside potential privilege escalation or remote code execution if specific database features are enabled."
}