Executive brief
The Media Sweep WordPress plugin is used to clean up and manage unused media files on WordPress websites. An authenticated administrator can exploit a SQL injection vulnerability by manipulating the 'fields' parameter to extract sensitive data from the website's database, potentially compromising customer information, login credentials, or other confidential content stored in WordPress.
Technical details
The plugin is vulnerable to SQL injection due to insufficient escaping and lack of prepared statement usage on the 'fields' parameter in its REST API controllers. The vulnerability affects all versions up to 1.1.3 and requires an authenticated attacker with administrator-level access. An attacker can inject arbitrary SQL queries to extract sensitive data from the WordPress database. The attack vector is network-based through the REST API endpoint, requiring authentication and administrative privileges as a precondition.
Affected products
- The Media Sweep WordPress Media Cleaner up to 1.1.3
Timeline
- 2026-08-25: disclosed