Description

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-10-11T07:17:28.070Z",
  "pubdate": "2026-10-11T07:17:28.070Z",
  "executiveSummary": "The Recordbrowser WordPress plugin, in versions up to 1.1.7, contains a critical SQL injection vulnerability. The flaw stems from insufficient input validation and sanitization of user-supplied parameters before they are integrated into backend database queries.\nThis vulnerability permits unauthenticated remote attackers to manipulate SQL statements, leading to unauthorized data exfiltration, modification, or potential administrative bypass. Because the application fails to enforce secure coding practices for database interactions, an attacker can execute arbitrary SQL commands.\nThe risk implication is high, as the vulnerability is exploitable without requiring authentication, granting any external actor the ability to interact directly with the underlying database. Successful exploitation could lead to full compromise of the database contents, exposing sensitive WordPress site data, including user credentials, configuration settings, and private application content.\nThe primary requirement for exploitation is network access to the affected web application. Organizations utilizing versions 1.1.7 or earlier are advised to treat this as a high-priority security issue, as it provides a direct vector for unauthorized information retrieval.",
  "technicalDetails": "The vulnerability resides within the Recordbrowser plugin's request handling logic, specifically where user-supplied input is processed without proper sanitization or the use of prepared statements. The root cause is the direct concatenation of untrusted input into dynamic SQL query strings.\nIn the vulnerable versions (up to 1.1.7), the plugin fails to implement sufficient abstraction or parameterized query interfaces. When an attacker supplies a crafted parameter containing SQL metacharacters (such as single quotes, semicolons, or comment indicators), the application's database abstraction layer processes these as executable commands rather than literal string data.\nThe exploitation flow begins when an unauthenticated attacker transmits a crafted HTTP request containing malicious SQL syntax to the susceptible endpoint. Because the application logic does not employ adequate input validation, the malicious payload is concatenated directly into the backend SQL statement. This allows the attacker to terminate the intended query prematurely and append unauthorized queries using the UNION operator or time-based blind SQL injection techniques.\nBy manipulating the SQL execution flow, the attacker can effectively 'break out' of the intended application context. This provides the capability to query the database structure, enumerate tables, extract sensitive columns (such as the wp_users table), or potentially modify existing records. In cases where the database user has elevated privileges, the attacker could theoretically execute administrative functions or perform command-line interaction if the database configuration permits such operations.\nThe vulnerability is particularly dangerous because it bypasses all application-level authentication mechanisms. Since the malicious query is processed by the database before any authentication check would typically be completed, the attacker gains access to data regardless of their authorization status. Post-exploitation impact ranges from data exfiltration—which violates privacy compliance—to full site compromise via the acquisition of administrative session tokens or credentials found within the database.\nGiven that the injection occurs within a WordPress plugin, the database scope typically encompasses the entire site, including core WordPress tables and other installed plugins. This centralization makes the SQL injection point a high-value target for automated exploit scripts seeking to compromise multiple installations simultaneously."
}