Description

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-20T12:16:36.813Z",
  "pubdate": "2026-08-20T12:16:36.813Z",
  "executiveSummary": "A vulnerability classified as SQL Injection exists within the WP w3all phpBB plugin, affecting all versions up to and including 3.0.5. The flaw resides in how user-supplied input is processed before being incorporated into database queries.\nAn authenticated attacker with low-level privileges, specifically a Subscriber, can exploit this security deficiency to manipulate SQL query logic. Successful exploitation of this vulnerability allows unauthorized access to sensitive database contents, including application data, user credentials, and potentially underlying system information depending on database configurations and privileges.\nThe risk implication is critical, as it enables authenticated users to bypass intended access controls and execute arbitrary database commands via crafted HTTP requests.\nExploitation requires network access to the vulnerable WordPress installation, an active authenticated session with Subscriber-level privileges, and specific input vectors within the affected WP w3all phpBB component that fail to implement proper input sanitization and parameterized queries.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in SQL commands within the WP w3all phpBB plugin for versions <= 3.0.5. The root cause is the direct concatenation or unsafe handling of user-controlled input into dynamic SQL queries without adequate escaping or the enforcement of prepared statements.\nThe vulnerable component processes requests initiated by users holding the Subscriber role. Because the input validation mechanisms are insufficient, an attacker possessing standard Subscriber privileges can supply specially crafted payloads containing SQL syntax characters through vulnerable parameters.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts an HTTP request containing malicious SQL injection payloads targeting the vulnerable endpoint of the WP w3all phpBB integration. Second, the WordPress application routes the request to the plugin handler. Third, the vulnerable function processes the input and dynamically constructs a SQL query by embedding the unsanitized parameters directly into the statement.\nFourth, the database management system executes the resulting query, interpreting the attacker's input as executable SQL commands rather than literal data. This allows the attacker to alter the query logic, perform union-based data retrieval, extract sensitive information from underlying database tables, or execute blind SQL injection techniques.\nThe attack vector is network-based, requiring the attacker to authenticate to the WordPress site with at least Subscriber-level privileges. Post-exploitation impact includes the potential extraction of confidential database records, compromise of user authentication tokens, and further escalation of privileges if database permissions are overlymissive."
}