WordPress Auction <= 3.7 - Editor+ SQL Injection
Description
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=3.7
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization and escaping of a parameter before use in a SQL statement allows SQL injection."
Attack vector
An attacker with Editor-level privileges or higher can exploit the unsanitized parameter before it is used in a SQL statement [ref_id=1]. The attacker sends a crafted HTTP request containing malicious SQL in the vulnerable parameter. Because the input is not escaped, the SQL injection payload is executed directly against the WordPress database [CWE-89]. This allows the attacker to extract, modify, or delete arbitrary data from the database.
Affected code
The advisory does not specify the exact file or function name within the WordPress Auction plugin (slug: wp-auctions) that contains the vulnerable parameter. The plugin version through 3.7 is affected.
What the fix does
The advisory states that no known fix is available for the WordPress Auction plugin through version 3.7 [ref_id=1]. To remediate the vulnerability, the plugin should sanitize and escape the user-supplied parameter before including it in a SQL query, typically by using WordPress's `$wpdb->prepare()` method or similar parameterized query functions. Until a patched version is released, site administrators should restrict Editor-level access or disable the plugin.
Preconditions
- authAttacker must have an account with Editor-level privileges or higher on the WordPress site
- inputThe vulnerable parameter must be reachable via a crafted HTTP request
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/04084f2a-45b8-4249-a472-f156fad0c90a/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.