Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-10-09T10:16:43.740Z",
  "pubdate": "2026-10-09T10:16:43.740Z",
  "executiveSummary": "The tagDiv Opt-In Builder plugin for WordPress, specifically versions 1.7.6 and earlier, is susceptible to a Blind SQL Injection vulnerability.\nThe flaw originates from improper neutralization of user-supplied input before it is utilized in database queries.\nThis vulnerability allows an unauthenticated or authenticated attacker to execute arbitrary SQL commands against the underlying application database.\nBy manipulating parameters, an attacker can infer sensitive information from the database character-by-character through boolean or time-based inference techniques.\nThe impact includes potential unauthorized access to site data, user credentials, and configurations, leading to a complete compromise of the database layer.\nThe vulnerability represents a critical risk to the confidentiality and integrity of the affected WordPress site, necessitating immediate remediation to prevent data exfiltration.",
  "technicalDetails": "The vulnerability is categorized as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').\nThe root cause is the failure of the tagDiv Opt-In Builder plugin to implement sufficient parameterization or sanitization mechanisms for input parameters processed by the plugin's subscription components.\nBecause the application performs dynamic SQL query construction without enforcing strict input validation or using prepared statements, malicious input can alter the logical structure of the SQL query being executed.\nThis instance manifests as a Blind SQL Injection, which typically forces the database to evaluate true/false conditions or induce time-based delays depending on whether the injected conditions are met.\nThe attack flow begins when an attacker identifies an unsanitized input vector within the plugin's request handling logic. The attacker sends crafted HTTP requests containing SQL fragments designed to probe the database structure.\nFor instance, if the application fails to handle quotes or mathematical operators correctly in a specific subscription parameter, the attacker can append clauses such as 'AND (SELECT ...)' to the legitimate query.\nBy observing changes in the HTTP response content (boolean inference) or variations in response latency (time-based inference), the attacker systematically extracts data, such as database versioning, table names, administrative usernames, or password hashes.\nThe vulnerability exists in all versions of the tagDiv Opt-In Builder plugin from n/a up to and including 1.7.6.\nThe attack can be performed remotely via the web interface. Depending on the specific implementation of the plugin's frontend or backend endpoints, exploitation may not require prior authentication, significantly increasing the risk profile.\nSuccessful exploitation results in the unauthorized exposure of database content, potentially leading to privilege escalation if administrative credentials are recovered, or unauthorized modification of data if the database user permissions are overly permissive."
}