WordPress Plugin Organizer SQL Injection Vulnerability in Versions Prior to 10.2.4

A SQL injection vulnerability has been identified in the WordPress Plugin Organizer plugin, affecting versions prior to 10.2.4. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This oversight enables subscribers to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, log in as an administrator and navigate to the Plugin Organizer global plugins page. Click the second 'Save' button. Then, log in as a subscriber and save the cookies to a file. Use these cookies to execute a SQL injection payload via the 'PO_perform_plugin_search' AJAX action. The injected payload can, for example, use the 'SLEEP' function to demonstrate the injection by causing a delay in the response.

Remediation

Users are advised to update the WordPress Plugin Organizer plugin to version 10.2.4 or later.