Description

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-10-11T07:17:28.440Z",
  "pubdate": "2026-10-11T07:17:28.440Z",
  "executiveSummary": "The Datalist WordPress plugin, in versions up to and including 0.0.3, is susceptible to an unauthenticated SQL injection vulnerability.\nThe vulnerability arises due to the insufficient sanitization and escaping of user-supplied request parameters utilized in database query construction.\nSuccessful exploitation allows an unauthenticated attacker to manipulate SQL queries, leading to unauthorized access to sensitive information stored within the WordPress database.\nThe risk is critical, as it bypasses application-level authentication mechanisms and permits the extraction of data such as user credentials, site configuration, and potentially sensitive plugin data.\nNo specific privileges or interaction from an administrative user are required to trigger this vulnerability, making it highly exploitable over the network.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in a SQL command, categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).\nThe Datalist plugin fails to implement adequate input validation or parameterized queries when processing request parameters.\nSpecifically, when the application receives a request, it retrieves values directly from superglobals (such as $_GET or $_POST) and incorporates these values into dynamically constructed SQL statements.\nBecause these inputs are not processed through WordPress database abstraction functions like $wpdb->prepare(), the database engine cannot distinguish between developer-intended commands and attacker-supplied SQL directives.\nAn attacker can exploit this by crafting malicious HTTP requests where the input parameters contain SQL injection payloads. By injecting meta-characters such as single quotes ('), semicolons (;), or comment sequences (-- or #), an attacker can terminate the intended query and append arbitrary SQL logic.\nThe attack flow proceeds as follows: 1) The attacker identifies the vulnerable endpoint within the Datalist plugin that processes user input. 2) The attacker submits a crafted request containing a SQL injection string instead of the expected data type. 3) The vulnerable component concatenates this input into a backend SQL query. 4) The database engine executes the injected SQL command. 5) The result set, which may include sensitive data from other tables or entire database contents, is returned in the application response, or alternatively, the attacker performs blind SQL injection to infer data based on application responses.\nThis vulnerability is reachable remotely over the network without requiring any form of authentication or high-privilege account access, exposing the entire database to unauthorized read operations. Post-exploitation impact typically involves data exfiltration, though depending on the database user permissions and backend configurations, more severe impacts such as data modification or administrative account takeover remain theoretically possible."
}