Description

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T15:17:09.833Z",
  "pubdate": "2026-08-18T15:17:09.833Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the Readabler plugin for WordPress, specifically affecting versions prior to 2.0.18. This security flaw arises from insufficient sanitization and validation of user-supplied input before it is concatenated directly into database queries. The vulnerability exposes the underlying database to remote, unauthenticated threat actors, allowing them to execute arbitrary SQL commands.\nThe risk implications of this vulnerability are severe, as successful exploitation grants attackers unauthorized access to sensitive application data, including user credentials, configuration settings, and potentially the entire contents of the WordPress database. Depending on database configurations and privileges, an attacker could extract sensitive information, bypass authentication mechanisms, or manipulate database records.\nExploitation of this vulnerability requires network access to the target web application running the vulnerable Readabler product. Because the flaw is unauthenticated, no prior access, user interaction, or privileged credentials are required for an attacker to initiate and execute malicious SQL queries against the affected system. Organizations utilizing the vulnerable software face an immediate risk of data exfiltration and database compromise if left unpatched.",
  "technicalDetails": "The vulnerability is classified as an SQL Injection (SQLi) flaw residing within the database interaction layer of the Readabler product. The root cause of the issue stems from improper neutralization of special elements used in SQL commands, specifically the failure to utilize parameterized queries, prepared statements, or robust input sanitization functions on incoming parameters before they are processed by the database management system.\nThe affected component handles HTTP requests submitted by users, extracting parameters that are subsequently incorporated into dynamic SQL queries without adequate validation. Because the code trusts the incoming input parameters, an attacker can manipulate these values by injecting malicious SQL syntax, operators, and subqueries directly into the application's request flow.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies an entry point or endpoint exposed by the Readabler plugin that processes user input intended for database retrieval or manipulation. Second, the attacker crafts a specialized HTTP request containing a malicious SQL payload designed to alter the logic of the underlying database query. Third, the vulnerable application accepts the input and constructs a dynamic SQL statement incorporating the uninfected or modified payload. Fourth, the database executes the resulting query, thereby returning unauthorized data, performing unintended database operations, or exposing database error messages that can be leveraged for further exploitation.\nThe vulnerability affects all versions of Readabler prior to 2.0.18. Since the exploitation vector is network-exposed and does not require authentication or specific privileges, any external entity with HTTP reachability to the target web server can initiate the attack. The post-exploitation impact includes the potential retrieval of sensitive database tables, administrative account takeover through credential harvesting or modification, and overall compromise of the confidentiality, integrity, and availability of the database system."
}