WordPress Filter & Grids Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Filter & Grids plugin for WordPress, affecting all versions through 3.2.0. The issue arises from inadequate escaping of user-supplied data in the 'phrase' parameter, allowing unauthenticated attackers to inject additional SQL queries. This vulnerability is exploitable on MariaDB, where the injected queries can be used to extract sensitive information from the database; on MySQL, the injection leads to a syntax error.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to access or modify database information. In this case, it could be used to extract sensitive data from the database.

Reproduction

To reproduce this vulnerability, send a request to a WordPress site with the Filter & Grids plugin installed, using the 'phrase' parameter. The injection will be successful if the site is using MariaDB and the plugin version is 3.2.0 or earlier.

Remediation

Users are advised to update the Filter & Grids plugin to version 3.2.1 or later.