Description

Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-10T15:17:46.360Z",
  "pubdate": "2026-09-10T15:17:46.360Z",
  "executiveSummary": "The Verified Reviews (Avis Vérifiés) plugin for versions 2.4.6 and below is susceptible to an unauthenticated SQL injection vulnerability. This critical flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database management system associated with the hosting application. By manipulating input parameters that lack sufficient sanitization or parameterization, an attacker can bypass security controls to access, modify, or delete sensitive data stored within the database.\nThe vulnerability presents a severe risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation does not require administrative privileges or prior authentication, significantly lowering the barrier for entry for malicious actors. Potential impacts include unauthorized data exfiltration (such as user credentials, PII, or transaction history), complete database takeover, or the execution of arbitrary administrative operations depending on the database user permissions. Given the nature of the flaw, it is categorized as a high-severity risk, necessitating immediate attention to prevent compromise of the application's data layer.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the Verified Reviews (Avis Vérifiés) plugin, where user-supplied input is passed directly into SQL queries without proper neutralization of special elements. This lack of input validation and the absence of prepared statements or parameterized queries create an injection vector that allows an attacker to break out of the intended query context.\nThe attack flow begins when an attacker identifies a publicly accessible endpoint or form field processed by the plugin. By injecting crafted SQL fragments—typically involving UNION-based, boolean-based, or time-based blind SQL injection techniques—the attacker can manipulate the query structure. Because the application fails to utilize appropriate database abstraction layers or prepared statements, the database engine interprets the attacker's input as executable code rather than literal data. For example, by terminating a SELECT statement and appending a UNION SELECT query, an attacker can extract arbitrary rows from unrelated tables, such as the wp_users table in a WordPress environment.\nThe vulnerable component is within the plugin's data processing logic, which fails to apply adequate sanitization routines (such as esc_sql() or wpdb::prepare() in the context of WordPress development) prior to query execution. This creates a flaw in the trust boundary where input from unauthenticated sources is treated as trusted database commands. Versions 2.4.6 and below are confirmed as affected, as they lack the remediation logic required to neutralize these malicious payloads.\nExploitation is possible over the network, with no requirements for authentication or elevated privileges. The exposure is total; an attacker can perform blind SQL injection to infer data byte-by-byte by observing time delays or variations in server responses, even if the database does not return results directly to the browser. The post-exploitation impact ranges from data breach to full site takeover, as attackers may be able to create new administrative accounts by inserting records directly into the user table or modifying site configurations stored within the database. The root cause is categorized as an implementation failure regarding CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)."
}