Description

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-12T06:16:26.910Z",
  "pubdate": "2026-09-12T06:16:26.910Z",
  "executiveSummary": "The Album Cover Finder WordPress plugin, in versions up to and including 0.7.0, contains a critical SQL injection vulnerability. This flaw arises from the improper sanitization and escaping of user-supplied input before it is processed in backend database queries.\nThe vulnerability allows unauthenticated, remote attackers to manipulate SQL commands, potentially leading to unauthorized access to sensitive database information. Given the nature of SQL injection, this could facilitate data exfiltration, modification of application content, or further exploitation of the underlying database server.\nThe risk is categorized as high due to the lack of required authentication, enabling any remote user with network access to the target WordPress installation to attempt exploitation. There are no specific complex prerequisites mentioned, suggesting a straightforward injection path targeting the plugin's interaction with the WordPress database layer.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the input validation and sanitization processes within the Album Cover Finder plugin code. Specifically, the plugin passes user-provided parameters directly into database queries without employing parameterized queries or adequate escaping mechanisms required to neutralize malicious SQL syntax.\nThe vulnerability occurs because the application logic fails to distinguish between data provided by a user and the control structures of the SQL statement. When a parameter—intended for legitimate application use—is manipulated by an attacker, the injected SQL commands are executed by the database engine within the security context of the web application.\nThe attack flow proceeds as follows: 1) The attacker identifies the vulnerable entry point in the plugin's web interface. 2) The attacker crafts a malicious HTTP request containing a specially formed SQL payload within the targeted parameter. 3) The plugin processes the request and embeds the payload directly into a SQL query string. 4) The database server executes the concatenated query, allowing the attacker to alter the query logic. 5) The results of the malicious query are returned to the attacker or silently executed, leading to unauthorized actions such as data disclosure or backend administrative bypass.\nThis vulnerability is classified as an unauthenticated SQL injection. Since the flaw resides in a public-facing plugin, it is reachable via the network without requiring any prior authentication or administrative privileges. The post-exploitation impact is limited only by the permissions of the database user configured for the WordPress instance; if the application uses a high-privileged database account, an attacker could potentially gain full control over the application's data or perform arbitrary operations against the database architecture."
}