Executive brief
The Library Management System WordPress plugin is a popular tool for managing and displaying book catalogues on WordPress sites. The plugin contains a SQL injection vulnerability that allows any user with a Subscriber account (the lowest standard user role) to extract sensitive data from the website's database, including user login credentials and password hashes. An attacker with a basic subscriber account can read the entire WordPress user table and other database contents without additional privileges.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the plugin's AJAX handler (owt_lib_handler action) affecting the owt7_lms_data_option_filters parameter. The vulnerable code fails to sanitize and escape user input from the 'value' parameter before constructing SQL queries across multiple modules (books, sections, users). The attack requires a valid user account with Subscriber role or higher and a nonce that is publicly exposed in the shortcode output. An attacker can craft UNION-based SQL injection payloads to extract arbitrary data including user credentials. The vulnerability affects all versions before 3.6.7 and has been patched in that release.
Affected products
- WP Library Management System Library Management System before 3.6.7
Timeline
- 2026-08-05: disclosed
- 2026-08-10: advisory: NVD published
- 2026: patched: Fixed in version 3.6.7