Executive brief
The KittyCatfish plugin for WordPress, which is used for managing advertisements, contains a security flaw that allows unauthorized individuals to access the website's database. By sending a specially crafted web request, an attacker can bypass security controls to steal sensitive information such as user credentials, customer data, or site configuration details. This vulnerability poses a significant risk to data confidentiality and the overall security of the WordPress installation.
Technical details
A SQL injection vulnerability exists in the KittyCatfish plugin (version 2.2 and earlier) for WordPress due to improper neutralization of the 'kc_ad' GET parameter. The flaw is located within the base.css.php and kittycatfish.php files, where user-supplied input is used in a database query without sufficient escaping or sanitization. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests to perform boolean-based or time-based blind SQL injection. Successful exploitation allows the attacker to extract sensitive information from the WordPress database. The plugin was closed on the WordPress repository in 2012 and remains unpatched; users are advised to uninstall the software.
Affected products
- Missilesilo KittyCatfish <= 2.2
Timeline
- 2017-03-06: disclosed: Vulnerability discovered and developer informed
- 2017-03-20: advisory: Public release of security advisory and exploit code
- 2026-06-09: advisory: CVE record published and NVD entry created