WP Bulk Delete WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WP Bulk Delete plugin for WordPress, affecting all versions up to and including 1.4.2. The vulnerability arises from inadequate escaping of user-supplied data in the 'delete_user_roles' parameter, allowing authenticated attackers with administrator-level access to inject additional SQL queries. This could be exploited to extract sensitive information from the database. The issue is exacerbated by the use of wp_unslash() on the raw POST data, which removes WordPress's magic quotes protection, leaving the injected values unescaped before they are processed by the SQL query.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to access or modify database information. In this case, it could lead to unauthorized data exposure or manipulation.

Reproduction

To reproduce this vulnerability, an authenticated user with administrator privileges can send a POST request to the WordPress site with the 'delete_user_roles' parameter. The absence of proper input validation and SQL query preparation allows for the injection of malicious SQL code, which could be used to extract sensitive data from the database.

Remediation

Users are advised to update the WP Bulk Delete plugin to version 1.4.3 or later, where this vulnerability has been addressed.