Executive brief
The ClearSale Total plugin for WordPress, which provides fraud protection services, is vulnerable to a security flaw that allows unauthorized individuals to access sensitive database information. By sending a specially crafted request, an attacker can bypass security checks and run their own database commands. This could lead to the theft of customer data or other confidential site information, particularly on servers running older versions of PHP.
Technical details
The ClearSale Total plugin for WordPress (up to version 3.4.2) contains an unauthenticated SQL injection vulnerability within the 'clearsale_total_push' AJAX action. Although a nonce check is present, the code fails to terminate execution when the check fails because the 'die()' call is commented out. On systems running PHP versions earlier than 8.0, loose type juggling allows an attacker to bypass a switch-case guard by providing a string that starts with a valid integer (e.g., '4 AND SLEEP(5)'). This input is then passed unquoted into an UPDATE SQL query. Attackers can leverage this to execute arbitrary SQL commands and exfiltrate data from the WordPress database.
Affected products
- ClearSale ClearSale Total <= 3.4.2
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/clearsale-total/tags/3.3.2/includes/class-clearsale-total-ajax.php
- https://plugins.trac.wordpress.org/browser/clearsale-total/tags/3.4.2/includes/class-clearsale-total-ajax.php
- https://plugins.trac.wordpress.org/browser/clearsale-total/trunk/includes/class-clearsale-total-ajax.php
- https://plugins.trac.wordpress.org/browser/clearsale-total/trunk/includes/class-clearsale-total-ajax.php
- https://plugins.trac.wordpress.org/browser/clearsale-total/trunk/includes/class-clearsale-total.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/871f6611-3b5e-4e36-992c-726b31e88c95?source=cve