Executive brief
Throws SPAM Away is a WordPress plugin that filters spam comments. Versions up to 3.8.2 contain an unauthenticated SQL injection vulnerability that allows attackers without user accounts to directly read, modify, or delete the website's entire database, including user credentials and sensitive customer data. This represents a complete compromise of the affected WordPress installation.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in the Throws SPAM Away plugin that does not require authentication to exploit. The injection point allows attackers to craft malicious SQL queries through the plugin's input handling. By sending specially crafted requests over the network, an unauthenticated attacker can execute arbitrary SQL commands against the WordPress database, potentially reading all data (user accounts, posts, private information), modifying records, or deleting content entirely. The vulnerability is fixed in version 3.9 and later.
Affected products
- Throws SPAM Away Throws SPAM Away <= 3.8.2
Timeline
- 2026-08-31: disclosed
- 2026-08-28: advisory: Patchstack advisory issued