Executive brief
The Plugin Organizer plugin for WordPress, which allows administrators to manage and reorder how plugins load, contains a security flaw that could allow users with low-level accounts (like subscribers) to access sensitive information. By exploiting a weakness in how the plugin searches for data, an attacker can run unauthorized database queries. This could lead to the exposure of private site data, including user details or configuration settings. The issue has been addressed in version 10.2.5.
Technical details
A SQL injection vulnerability exists in the perform_plugin_search() function of the Plugin Organizer plugin for WordPress. The root cause is insufficient escaping of the 'PO_plugin_path' parameter; specifically, the output of esc_sql() is passed as a replacement string to preg_replace(), which collapses backslash escapes and bypasses quoting protections. Furthermore, the associated AJAX handler lacks proper nonce verification and capability checks. Authenticated attackers with subscriber-level permissions or higher can exploit this to append malicious SQL queries and extract sensitive data. The vulnerability is fixed in version 10.2.5.
Affected products
- foomagoo Plugin Organizer up to, and including, 10.2.4
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in version 10.2.5
References
- https://plugins.trac.wordpress.org/browser/plugin-organizer/tags/10.2.4/lib/PO_Ajax.class.php
- https://plugins.trac.wordpress.org/browser/plugin-organizer/tags/10.2.4/lib/PO_Ajax.class.php
- https://plugins.trac.wordpress.org/browser/plugin-organizer/tags/10.2.4/lib/PluginOrganizer.class.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3603359%40plugin-organizer%2Ftags%2F10.2.5%2Flib%2FPO_Ajax.class.php&old=%20%20%203405892%40plugin-organizer%2Ftags%2F10.2.4%2Flib%2FPO_Ajax.class.php&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ca06c0-6a7d-43ee-ac59-698e0f525e23?source=cve