WordPress Donation Plugin SQL Injection Vulnerability in Versions Through 1.0

A SQL injection vulnerability has been identified in the WordPress Donation plugin, affecting versions through 1.0. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This flaw enables high-privilege users, such as administrators, to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Reproduction

To reproduce this vulnerability, log in as an admin user and navigate to the WordPress admin panel. Open the 'admin.php' page for the Donation plugin, and include a crafted SQL injection payload in the 'id' parameter. The payload can be designed to, for example, select data from the database using SQL injection techniques.