{"uuid": "696f3fd1-35d5-4e40-869a-a3bdcf9d14fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23489", "type": "seen", "source": "https://t.me/hacking_Attack/85447", "content": "Black Hat Ethical Hacking\nPoC exploits released for critical bugs in popular WordPress plugins\n\nPoC exploits released for critical bugs in popular WordPress pluginsPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Three popular WordPress plugins with tens of thousands of active installations are vulnerable to high-severity or critical SQL injection vulnerabilities, with proof-of-concept exploits now publicly available.SQL injection is a website security flaw that allows attackers to input data into form fields or via URLs that modify legitimate database queries to return different data or modify a database.\n\nDepending on the website code being vulnerable to a SQL injection flaw, an attacker could modify or delete data to a site, inject malicious scripts, or gain full access to the website.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Proof of Concept exploits released The three vulnerable plugins were discovered by Tenable\u00a0security researcher Joshua Martinelle, who reported them responsibly to WordPress on December 19, 2022, along with proofs of concept (PoCs).\n\nThe authors of the plugins released security updates to address the issues in the following days or weeks, so all problems have been fixed now, and those running the latest available version are no longer vulnerable.\n\nYesterday, the researcher disclosed technical details about each vulnerability with proof of concept exploits using the SLEEP function to demonstrate how the flaws work.\n\nThe first plugin that was found to be vulnerable to SQL injection is \u2018Paid Memberships Pro,\u2019 a membership and subscriptions management tool used in over 100,000 websites.\n\n\u201cThe plugin does not escape the \u2018code\u2019 parameter in the /pmpro/v1/order REST route before using it in a SQL statement, leading to an unauthenticated SQL injection vulnerability,\u201d reveals Tenable\u2019s post.\n\nThe flaw is tracked as CVE-2023-23488, receiving a CVSSv3 severity rating of 9.8 (critical), and it affects all versions of the plugin older than 2.9.8. Paid Memberships Pro fixed the vulnerability on December 27, 2022, with the release of version 2.9.8.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/WordPress/1/curl.png \n<figcaptionProvided example of a test attack leveraging CVE-2023-23488 (Tenable) \nThe second WordPress add-on vulnerable to SQL injection is \u2018Easy Digital Downloads,\u2019 an e-commerce solution for selling digital files with over 50,000 active installations.\n\n\u201cThe plugin does not escape the \u2018s\u2019 parameter in the \u2018edd_download_search\u2019 action before using it in a SQL statement, leading to an unauthenticated SQL injection vulnerability,\u201d explains Tenable.\n\n\u201cThe vulnerable part of the code corresponds to the \u2018edd_ajax_download_search()\u2019 function of the \u2018./includes/ajax-functions.php\u2019 file.\u201d\n\nThe vulnerability is tracked as CVE-2023-23489 and has received a CVSSv3 severity rating of 9.8, categorizing it as critical. The flaw impacts all versions below 3.1.0.4, released on January 5, 2023.\n\nFinally, Tenable discovered CVE-2023-23490, a \u2018high-severity\u2019 SQL injection flaw in \u2018Survey Marker,\u2019 a WordPress plugin used by 3,000 websites for surveys and market research.\nTrending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Freeze\nThe flaw received a severity rating of 8.8, according to the CVSS v3, because the attacker has to be authenticated as at least a subscriber to exploit it.\n\nHowever, this prerequisite is usually easy to fulfill, as many websites allow visitors to register as members.\n\nSurvey Marker was the quickest vendor to respond to Tenable\u2019s SQL injection[...]", "creation_timestamp": "2026-09-02T01:01:27.763033Z"}