Executive brief
The Boost plugin for WordPress, which is used to optimize website performance, contains a security flaw that allows unauthorized individuals to access private database information. By sending specially crafted requests to a website using this plugin, an attacker can bypass security measures to extract sensitive data such as user credentials or site configuration details. This could lead to a full compromise of the website's data and potentially its administrative accounts.
Technical details
The Boost plugin for WordPress is vulnerable to time-based SQL injection due to insufficient escaping of user-supplied input and a lack of proper SQL query preparation. Specifically, the 'current_url' and 'user_name' parameters are not correctly sanitized before being included in database queries. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests containing malicious SQL commands. Because the vulnerability is time-based, the attacker can infer data from the database based on the time it takes for the server to respond. This allows for the extraction of sensitive information from the WordPress database. The issue affects all versions up to and including 2.0.3.
Affected products
- PixelYourSite Boost plugin for WordPress up to, and including, 2.0.3
Timeline
- 2026-05-20: disclosed: NVD publication date