Description

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-30T13:17:32.357Z",
  "pubdate": "2026-09-30T13:17:32.357Z",
  "executiveSummary": "The Admin Notices Manager plugin for WordPress is susceptible to an authenticated SQL injection vulnerability affecting versions 1.6.0 and earlier.\nThe vulnerability originates from improper sanitization of user-supplied input before being incorporated into database queries within the administrative interface.\nAn authenticated attacker with administrative privileges can manipulate these queries to execute arbitrary SQL commands, leading to unauthorized data extraction, modification, or deletion within the underlying database.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the WordPress installation, as it allows for bypasses of standard data access controls.\nSuccessful exploitation requires the attacker to possess administrative-level access to the WordPress backend. The flaw is categorized as an SQL Injection (SQLi) vulnerability, which may be leveraged to perform unauthorized administrative actions or escalate privileges if configured incorrectly.\nThe scope of impact is limited to the database layer, potentially affecting site configurations, user accounts, and stored content.",
  "technicalDetails": "The root cause of this vulnerability is the failure to utilize secure database abstraction methods, such as prepare() statements, when handling input parameters within the Admin Notices Manager plugin. Specifically, the plugin takes input from administrative dashboard requests and processes them into SQL queries without adequate escaping or validation.\nThe vulnerable component involves the backend handling of notices, where internal functions dynamically build SQL strings based on user-controllable input fields. Because these inputs are not properly cast or parameterized, an attacker can perform a typical SQL injection attack by injecting malicious SQL syntax into the affected parameters.\nAttack flow typically follows these steps: 1. The attacker authenticates as an administrator to gain access to the plugin's configuration or notice management interface. 2. The attacker identifies an input parameter (e.g., via a GET or POST request) that is processed by the database query. 3. The attacker crafts a payload utilizing SQL operators such as UNION, SELECT, or sleep-based commands. 4. The server-side application concatenates the malicious payload into the query string. 5. The database executes the injected command with the privileges of the database user, returning unauthorized data or executing unintended logic.\nAffected versions include all releases of Admin Notices Manager up to and including version 1.6.0. The vulnerability is exploitable over standard web protocols (HTTP/HTTPS) and requires an active administrative session. Post-exploitation impact is severe, as the attacker can perform database-level operations, including but not limited to dumping credentials, modifying site options, or altering content to facilitate further malicious activity such as Cross-Site Scripting (XSS) or administrative backdoors.\nBecause the vulnerable code operates on the administrative side, it allows the attacker to execute queries directly against the WordPress wp_ database tables, which contain highly sensitive information. Given the nature of SQL injection, the attacker can leverage blind-based or error-based techniques to systematically extract database structure and contents."
}