ClickandPledge WordPress Plugin Privilege Escalation Vulnerability via SQL Injection

A SQL injection vulnerability allowing privilege escalation has been identified in the ClickandPledge WordPress plugin, specifically in versions through 25.04010101-WP6.8. This vulnerability arises from improper neutralization of special elements used in SQL commands, which could be exploited to escalate user privileges.

Impact

Exploitation of this vulnerability could allow a low-privileged user to gain higher privileges, potentially leading to full control of the website.

Remediation

Users of the ClickandPledge WordPress plugin are advised to update to a version beyond 25.04010101-WP6.8. For those unable to update immediately, Patchstack offers a virtual patch that blocks attacks targeting this vulnerability.