WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

Vulnerability

The SendGrid for WordPress plugin (slug: wp-sendgrid-mailer) versions through 1.4 contains an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. The vulnerability exists in the plugin's handling of user-supplied input that is directly used in SQL queries without proper sanitization or parameterization. Affected versions: all versions up to and including 1.4.

Exploitation

An attacker can exploit this vulnerability by sending crafted input to the plugin's functionality that interacts with the database. No authentication is required if the vulnerable endpoint is publicly accessible, but the exact attack vector is not detailed in available references. The attacker would need to identify the specific parameter(s) that are not sanitized and inject malicious SQL statements.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the WordPress database. This can lead to unauthorized access to sensitive data (e.g., user credentials, posts, options), modification or deletion of database content, and potentially further compromise of the WordPress installation.

Mitigation

No patched version is available. The plugin has been closed and removed from the WordPress.org plugin directory as of October 16, 2024, due to a security issue [1]. Users are advised to uninstall the plugin immediately and seek alternative solutions. No workaround is provided.