WP Project Manager SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WP Project Manager plugin for WordPress, specifically in versions prior to and including 2.6.16. The vulnerability arises in the '/wp-json/pm/v2/projects/2/task-lists' REST API endpoint, where the 'project_id' parameter is insufficiently sanitized. This flaw allows authenticated attackers with project access to inject additional SQL queries into the existing query, potentially leading to the extraction of sensitive database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to access or modify database information. In this case, it could be used to extract sensitive data from the database.

Reproduction

To reproduce this vulnerability, send a request to the '/wp-json/pm/v2/projects/2/task-lists' endpoint with an injected 'project_id' parameter. The injection can be crafted to manipulate the SQL query and extract database information.

Remediation

Users are advised to update the WP Project Manager plugin to version 2.6.17 or later, where this vulnerability has been fixed.