AI Scribe WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the AI Scribe WordPress plugin, specifically in versions through 2.3. The issue arises in the 'article_builder_generate_data' shortcode, where the 'template_id' parameter is not properly escaped, allowing authenticated attackers with Contributor-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to extract sensitive information from the database.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can use the 'article_builder_generate_data' shortcode, including a crafted 'template_id' parameter that exploits the insufficient input sanitization. This will append additional SQL commands to the existing query, potentially allowing access to sensitive database information.

Remediation

Users are advised to update the AI Scribe WordPress plugin to version 2.5, where this vulnerability has been fixed.