Executive brief
The Album Cover Finder WordPress plugin, used to automatically retrieve and display album artwork on websites, contains a critical flaw that allows attackers to inject malicious SQL commands without needing an account. An attacker can exploit this to extract sensitive data from the website's database, including user credentials, email addresses, and other confidential information, potentially compromising customer privacy and website integrity.
Technical details
This is an unauthenticated SQL injection (SQLi) vulnerability in the Album Cover Finder WordPress plugin through version 0.7.0. The plugin fails to properly sanitize and escape user input from the "and_action" parameter before incorporating it into a SQL query. The vulnerability is accessible to unauthenticated attackers via a network vector, meaning no WordPress login credentials are required to exploit it. Successful exploitation allows attackers to execute arbitrary SQL commands, leading to unauthorized data disclosure, data modification, or potential database takeover. No patch has been released as of the publication date.
Affected products
- Album Cover Finder Album Cover Finder through 0.7.0
Timeline
- 2026-09-10: disclosed