Executive brief
The Persistent Login plugin for WordPress contains a SQL injection vulnerability in its Login History feature that allows authenticated users with subscriber-level access to extract sensitive data from the website's database. An attacker could exploit this to access customer records, user credentials, or other confidential information stored in the database. The vulnerability only affects sites where the Login History feature is enabled.
Technical details
This is a generic SQL injection vulnerability in the Login History component of the Persistent Login plugin, caused by insufficient escaping and lack of parameterized queries on the 'wppl_device_id' cookie parameter. The vulnerability requires authentication (subscriber-level or above) and activation of the Login History feature to exploit. An authenticated attacker can inject arbitrary SQL into the database query via the unescaped cookie value to extract sensitive information. The vulnerability affects all versions up to and including 3.1.0; a patch is expected to address the insufficient escaping and implement proper prepared statements.
Affected products
- WordPress Persistent Login up to and including 3.1.0
Timeline
- 2026-09-01: disclosed