Executive brief
The OptinCraft plugin for WordPress, which is used to create marketing popups and opt-in forms, contains a security flaw that allows high-level users to run unauthorized database commands. An attacker with administrator privileges could exploit this to access sensitive information stored in the website's database. While this requires existing administrative access, it poses a risk of data theft or further compromise of the site's backend infrastructure.
Technical details
The OptinCraft plugin for WordPress is vulnerable to SQL injection due to insufficient escaping of the 'order_by' parameter and a lack of proper SQL query preparation. This vulnerability exists in all versions up to and including 1.2.0. An authenticated attacker with administrator-level permissions can exploit this flaw to append additional SQL queries to existing database calls. This allows for the extraction of sensitive information from the database. The issue is rooted in the CampaignController and CampaignRepository components where user input is directly concatenated into query strings.
Affected products
- OptinCraft OptinCraft – Drag & Drop Optins & Popup Builder for WordPress Up to and including 1.2.0
Timeline
- 2026-06-06: disclosed
- 2026-06-06: advisory
References
- https://plugins.trac.wordpress.org/browser/optincraft/tags/1.0.2/app/Http/Controllers/Admin/CampaignController.php
- https://plugins.trac.wordpress.org/browser/optincraft/tags/1.0.2/app/Repositories/CampaignRepository.php
- https://plugins.trac.wordpress.org/browser/optincraft/tags/1.0.2/vendor/vendor-src/wpmvc/database/src/Query/Compilers/Compiler.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3554161%40optincraft&new=3554161%40optincraft&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f28a95b0-0f7d-43c4-acf9-13c561245f4b?source=cve