Unlimited PopUps <= 4.5.3 - Author+ SQL Injection
Description
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Unlimited PopUpsdescription
- Range: <=4.5.3
Patches
Vulnerability mechanics
Root cause
"The `did` GET parameter is directly concatenated into a SQL DELETE statement without sanitization or escaping."
Attack vector
An attacker with Editor-level access sends a crafted GET request to `/wp-admin/admin.php?page=popup&info=del&did=` with a malicious SQL payload appended to the `did` parameter. The plugin passes this unsanitized value directly into a `DELETE` query, allowing time-based blind SQL injection (e.g., using `SLEEP(5)`) [ref_id=1]. The attack is authenticated and requires the Editor role, but no other special network conditions are needed.
Affected code
The vulnerability resides in `popuplist.php` at line 16, where the `did` GET parameter is taken directly from `$_GET["did"]` and concatenated into a DELETE SQL query without any sanitization, validation, or escaping [ref_id=1].
What the fix does
The advisory does not include a patch diff, but the fix would require sanitizing or escaping the `did` parameter before using it in the SQL query, such as casting it to an integer or using `$wpdb->prepare()` with a placeholder [ref_id=1]. Without this change, any Editor or Administrator can inject arbitrary SQL commands via the `did` parameter.
Preconditions
- authThe attacker must have a WordPress account with at least the Editor role.
- networkThe attacker must be able to send HTTP GET requests to the vulnerable admin page.
- inputThe `did` GET parameter is accepted without sanitization.
Generated on May 29, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- codevigilant.com/disclosure/2021/wp-plugin-unlimited-popups/mitrex_refsource_MISC
- wpscan.com/vulnerability/9841176d-1d37-4636-9144-0ca42b6f3605mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.