Description

Administrator SQL Injection in Estatik <= 4.3.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-30T13:17:29.430Z",
  "pubdate": "2026-09-30T13:17:29.430Z",
  "executiveSummary": "The Estatik plugin for WordPress, in versions 4.3.5 and below, contains a critical SQL Injection vulnerability. This flaw arises from the improper sanitization of user-supplied input before it is concatenated into database queries. An attacker possessing administrative-level privileges can manipulate these queries to execute arbitrary SQL commands against the underlying database.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. Successful exploitation allows an authenticated administrator to bypass standard application logic, potentially leading to unauthorized data exfiltration, modification of database records, or full administrative control over the database management system. Given the nature of SQL injection, this could facilitate further compromise of the web server or the exposure of sensitive user data. Exploitation requires valid administrative credentials, limiting the attack surface to malicious insiders or attackers who have already compromised an administrative account.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Estatik plugin to adequately validate and sanitize input parameters passed to database-interacting functions. In affected versions (<= 4.3.5), the plugin dynamically constructs SQL queries using unsanitized administrative input, allowing the injection of malicious SQL syntax. This violates the principle of separating data from command logic in database queries.\nThe attack flow requires the adversary to hold an account with administrative privileges within the WordPress environment. An attacker intercepts legitimate requests made to the Estatik plugin's administrative interface, specifically targeting parameters processed by the vulnerable component. By injecting crafted SQL payloads—such as UNION-based statements or boolean-based blind injection strings—into these parameters, the attacker forces the database to execute unintended operations.\nThe vulnerability typically resides in the plugin's backend request handlers where user-submitted data from administrative settings or management forms is processed. Because the application logic fails to utilize parameterized queries (prepared statements) or robust input sanitization routines (such as $wpdb->prepare), the database engine treats the injected malicious SQL as part of the intended query. This enables the attacker to perform cross-database queries, extract sensitive information from other WordPress tables, or perform destructive operations such as dropping tables or updating user credentials to escalate or maintain persistence.\nBecause the payload is executed with the privileges of the database user configured for the WordPress instance, the impact is confined to the extent of the web server's database permissions. However, in most standard deployments, this is sufficient to gain full read/write access to all site data. Post-exploitation activities may include the dump of user tables containing password hashes, modification of plugin configurations to facilitate further malicious activity, or the injection of malicious scripts into the database that could lead to stored Cross-Site Scripting (XSS) or arbitrary code execution if the injected data is rendered in the front end or other administrative pages."
}