Description

Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-31T21:17:51.293Z",
  "pubdate": "2026-08-31T21:17:51.293Z",
  "executiveSummary": "The WordPress plugin 'Throws SPAM Away' version 3.8.2 and earlier contains a critical unauthenticated SQL injection vulnerability. This flaw arises due to improper neutralization of user-supplied input before incorporating it into database queries. An attacker can exploit this vulnerability to execute arbitrary SQL commands against the underlying database without requiring authentication or administrative privileges.\nThe impact of this vulnerability is severe, potentially allowing an unauthorized actor to bypass security controls, access sensitive information, modify data, or execute administrative operations. Because the vulnerability is exploitable by unauthenticated remote attackers, it poses a significant risk to the integrity, confidentiality, and availability of the affected WordPress site. Successful exploitation can lead to a full compromise of the database, facilitating unauthorized data exfiltration or potential site takeover.",
  "technicalDetails": "The vulnerability resides within the Throws SPAM Away plugin, specifically in how it processes incoming requests that are handled by the plugin's backend logic. The root cause is the failure to adequately sanitize or parameterize user-controllable input before it is passed to database query functions. By crafting malicious HTTP requests, an attacker can inject SQL syntax into these parameters, effectively altering the intended structure of the SQL query.\nExploitation does not require authentication, meaning any remote attacker can interact with the plugin’s exposed endpoints or hooks to trigger the flaw. The attack flow begins with the attacker identifying the entry point, typically a GET or POST parameter processed by the plugin. The attacker then submits a specially crafted payload—such as a series of SQL keywords and operators (e.g., 'UNION SELECT', 'SLEEP()', or 'BENCHMARK()')—to manipulate the query logic.\nBecause the input is not processed through proper preparation statements or rigorous validation, the database engine interprets the malicious input as part of the command execution flow. For instance, an attacker could inject UNION-based payloads to retrieve data from other tables, including sensitive records like user credentials, options, or configuration settings. Additionally, time-based blind SQL injection techniques could be utilized to infer database content bit-by-bit by observing differences in server response times.\nThis vulnerability is critical because it bypasses standard WordPress permission checks, as the vulnerable code paths are often reachable through the site's public-facing interfaces. The post-exploitation impact includes, but is not limited to, the exposure of the entire WordPress database, potential elevation of privileges, or the injection of malicious content into the database, which could then result in Cross-Site Scripting (XSS) or other secondary attacks. The lack of input validation and the use of dynamic query building within the vulnerable components represent a significant security oversight in the plugin's data handling architecture."
}