WordPress Product Catalog 8 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Product Catalog 8 plugin for WordPress, specifically in version 1.2.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the selectedCategory parameter. Exploitation involves sending POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action, which can be used to extract sensitive information from WordPress database tables.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a POST request to the WordPress admin-ajax.php endpoint. Include the selectedCategory parameter with a crafted SQL injection payload, such as a UNION SELECT statement. Also, set the action parameter to UpdateCategoryList.