Executive brief
The Bluff Post WordPress plugin fails to properly sanitize user input in SQL queries, allowing unauthenticated attackers to inject malicious SQL code. An attacker can exploit this vulnerability to extract sensitive data from the WordPress database, such as user credentials, personal information, or other confidential database contents.
Technical details
The plugin does not sanitize or escape the 'table_name' and 'column_name' parameters before using them as identifiers in SQL queries, enabling SQL injection (CWE-89). This unauthenticated attack vector allows attackers to append arbitrary SQL commands to extract sensitive information from the database. No patch is currently known to be available.
Affected products
- WPScan Bluff Post through 1.1.1
Timeline
- 2026-09-23: disclosed
- 2026-09-26: advisory