Executive brief
A SQL injection vulnerability in the Boost WordPress plugin allows unauthenticated attackers to directly query and manipulate the website's database without requiring login credentials. An attacker exploiting this flaw could steal customer data, user credentials, and site content, or permanently delete or corrupt the database—leading to data breach, compliance violations, and site downtime.
Technical details
The vulnerability is a classic SQL injection flaw in the Boost plugin (versions <= 2.0.4) that does not require authentication to exploit. The vulnerable component fails to properly sanitize or parameterize user input before constructing database queries. An attacker can craft malicious input through an unauthenticated network request to inject arbitrary SQL commands, achieving full database read, write, and delete access. As of the publication date (August 24, 2026), no official patch was available; mitigation via Web Application Firewall rules is recommended as a temporary measure.
Affected products
- WordPress Boost <= 2.0.4
Timeline
- 2026-08-24: disclosed
- 2026-07-03: other: Initial report by luc