CVE-2012-5350

Vulnerability

The Pay With Tweet plugin for WordPress versions before 1.2 contains a SQL injection vulnerability in the paywithtweet shortcode. The id parameter is not properly sanitized before being used in SQL queries, allowing authenticated users with certain permissions to inject arbitrary SQL commands.

Exploitation

An attacker must be an authenticated WordPress user with permissions to use the paywithtweet shortcode. The attacker can craft a malicious id parameter value containing SQL injection payloads. The shortcode processes this parameter without proper sanitization, leading to SQL injection.

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the WordPress database, potentially leading to data exfiltration, modification, or deletion. The attacker can gain unauthorized access to sensitive information.

Mitigation

The plugin has been closed as of February 27, 2012, and is no longer available for download [1]. Users should remove the plugin immediately. The fixed version 1.2 was released but the plugin is permanently closed. No other workaround is available.