Track Logins <= 1.0 - Admin+ SQL Injection
Description
The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3(expand)+ 1 more
- (no CPE)
- (no CPE)
- Range: <=1.0
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization and escaping of a parameter before use in a SQL statement allows SQL injection."
Attack vector
An attacker with Administrator-level access to the WordPress site can exploit the plugin by supplying a crafted value in an unsanitized parameter. The plugin does not sanitize or escape this parameter before incorporating it into a SQL statement [ref_id=1]. This allows the attacker to inject arbitrary SQL commands, potentially extracting or modifying database contents. The attack requires the attacker to be authenticated as an admin, limiting the attack surface to privileged users [CWE-89].
Affected code
The advisory does not specify the exact file or function name within the Track Logins plugin where the unsanitized parameter is processed [ref_id=1]. The vulnerable parameter is used directly in a SQL statement without sanitization or escaping.
What the fix does
No patch or fix has been published for this vulnerability as of the advisory's last update [ref_id=1]. The remediation guidance is to ensure that any parameter used in a SQL statement is properly sanitized and escaped before execution. Since the plugin is marked as having no known fix, users should consider disabling or replacing the plugin until a security update is released.
Preconditions
- authAttacker must be authenticated as an Administrator-level user on the WordPress site.
- inputThe vulnerable parameter must accept and process attacker-controlled input without sanitization.
Reproduction
The advisory does not include a step-by-step proof of concept, only a general description of the vulnerability [ref_id=1]. No reproduction steps are available from the provided bundle.
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/408e6cad-f02d-455a-9943-32da77537da1/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.