Description

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-30T13:17:24.227Z",
  "pubdate": "2026-09-30T13:17:24.227Z",
  "executiveSummary": "The Easy Pricing Tables plugin for WordPress, in versions 4.1.2 and below, contains a critical SQL injection vulnerability. This flaw arises from the improper sanitization of user-supplied input, allowing authenticated contributors to execute arbitrary SQL commands against the underlying database.\nThe vulnerability type is categorized as SQL Injection (SQLi), which can lead to unauthorized data exfiltration, modification, or deletion of sensitive information within the WordPress database. The impact is significant, as it grants an attacker the ability to bypass application-level access controls and manipulate the database backend directly.\nThe vulnerability affects any WordPress installation utilizing Easy Pricing Tables versions <= 4.1.2. The risk implications are severe, as exploitation could lead to a full compromise of the database, potentially resulting in unauthorized administrative access, sensitive user data exposure, or the injection of malicious scripts into the application environment.\nExploitation requires an attacker to possess at least 'Contributor' level privileges on the WordPress instance. While authentication is a prerequisite, the vulnerability allows for privilege escalation and broader data access, significantly increasing the threat profile of the authenticated user.",
  "technicalDetails": "The vulnerability exists due to insufficient input validation and improper neutralization of special elements used in SQL commands within the plugin's data processing functions. Specifically, the plugin fails to utilize prepared statements or appropriate escaping mechanisms when handling user-provided parameters during database query execution.\nThe root cause is located in the backend logic where input parameters derived from user actions are concatenated directly into SQL queries. This allows an attacker to manipulate the query structure by injecting malicious SQL fragments. An authenticated contributor can supply crafted input containing SQL syntax, which the application then executes within the context of the database user privileges.\nThe attack flow typically follows a predictable pattern: 1) An authenticated user with contributor permissions initiates an action handled by the vulnerable component of the Easy Pricing Tables plugin. 2) The user crafts a malicious payload containing SQL injection sequences designed to manipulate the query logic. 3) This payload is sent as part of an HTTP request to the vulnerable plugin endpoint. 4) The plugin processes the input without adequate sanitization, appending the malicious code to a query string. 5) The database executes the modified query, allowing the attacker to view, modify, or delete database contents.\nThe vulnerability exposes the application to various post-exploitation activities, including Blind SQL Injection or error-based SQL injection, depending on how the application handles query results and database errors. Through these techniques, an attacker can extract full database schemas, user credentials, or other critical configuration data. Furthermore, depending on the database configuration and permissions, it may be possible to escalate the attack to perform administrative operations within the database management system itself.\nThis vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The scope of impact is confined to the database layer, but given the central role of the database in WordPress, this effectively compromises the integrity and confidentiality of the entire web application. Because the vulnerability requires authentication, the attack surface is limited to internal users, but the potential for malicious insiders or compromised contributor accounts makes this a high-severity concern for any organization leveraging the plugin in a multi-user environment."
}