Executive brief
The Library Management System plugin for WordPress, which is used to manage book catalogs and library operations, contains a security flaw that allows unauthorized individuals to access the website's database. By exploiting this vulnerability, an attacker can steal sensitive information, including user account details and encrypted password hashes. This could lead to full site takeover or the exposure of private member data.
Technical details
The Library Management System WordPress plugin fails to properly sanitize and escape the 'book_id' user-supplied parameter before incorporating it into a SQL query. This results in a classic SQL injection (SQLi) vulnerability (CWE-89). An unauthenticated remote attacker can exploit this by sending specially crafted web requests to the affected WordPress site. Successful exploitation allows for the extraction of arbitrary data from the database, including sensitive information such as user password hashes. The vulnerability is addressed in version 3.5.8 of the plugin.
Affected products
- Unknown Library Management System < 3.5.8
Timeline
- 2026-06-22: disclosed: Publicly published by WPScan
- 2026-06-22: other: Added to WPScan database
- 2026-07-13: advisory: NVD publication date
- 2026-07-13: patched: Fix confirmed in version 3.5.8