Coder WordPress Plugin Unauthenticated SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Coder WordPress plugin, affecting versions through 1.3.4. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement via an AJAX action accessible to unauthenticated users.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Remediation

Users are advised to update the Coder WordPress plugin to version 1.4.0 or later, where this vulnerability has been fixed.