Proof of concept (PoC) code has been released for three critical vulnerabilities in WordPress plugins that allow for SQL injection into the website code. The affected plugins are Paid Memberships Pro, Easy Digital Downloads, and Survey Maker, all of which have now received security updates that patch the SQL injection flaws. A security researcher at Tenable discovered these flaws and reported them to WordPress last month, and has now released a security advisory detailing these flaws and their PoC code now that security patches are available.  

Paid Memberships Pro vulnerability CVE-2023-23488 and Easy Digital Downloads vulnerability CVE-2023-23489 are both critical severity unauthenticated SQL injection flaws with CVSS base scores of 9.8/10. The Paid Memberships Pro flaw occurs when the plugin tries to access the host WordPress site through the /pmpro/v1/order rest route. Whilst performing this function, it does not escape the ‘code’ parameter before using it in an SQL statement, allowing for attackers to inject SQL into the function without the need for authentication. Similarly, the flaw in the Easy Digital Downloads plugin occurs when a parameter is not escaped before being used in an SQL statement, but for this plugin it is the ‘s’ parameter in the edd_ajax_download_search() function.  

The Survey Maker plugin vulnerability CVE-2023-23490 differs from the other two SQL injection vulnerabilities in that the attacker must be authenticated first in order to perform an exploit. This is reflected in the lower CVSS base score for this vulnerability, which is 8.8/10, giving it a severity rating of ‘high’ rather than ‘critical’. An attacker needs ‘subscriber’ level privileges, not administrator level, in order to have the level of authentication needed to exploit this flaw. An attack can be performed when the ays_surveys_export_json function is used, as the plugin does not escape the ‘surveys_ids’ parameter before using it in an SQL statement, allowing for SQL injection through this parameter.  

Users of these plugins should update to Paid Memberships Pro version 2.9.8, Easy Digital Downloads version 3.1.0.4, and Survey Maker version 3.1.2 to apply the security fixes that patch these flaws.