Executive brief
The WP Inventory Manager WordPress plugin is vulnerable to SQL injection through a shortcode parameter, allowing authenticated contributors to extract sensitive data from the site's database. An attacker with contributor-level access can craft malicious shortcode attributes to bypass query protections and execute unauthorized database queries, risking exposure of customer information, credentials, and other confidential records stored in the database.
Technical details
A SQL injection vulnerability exists in the WPIMItem::get_all() function, specifically in the parse_custom_where() method that processes the 'where' shortcode attribute. The function performs insufficient input validation—only applying html_entity_decode(), stripping semicolons, and performing field-name replacements—without using $wpdb->prepare() parameterized queries or a whitelist. The unsanitized parameter is directly concatenated into a raw SELECT statement executed via $wpdb->get_results(). Exploitation requires authenticated access with Contributor role or higher. An attacker can append arbitrary SQL queries to extract sensitive database information. Patches are available in versions after 2.5.1.
Affected products
- WP Inventory Manager WP Inventory Manager up to 2.5.1
Timeline
- 2026-09-18: disclosed