Smart Manager for WordPress SQL injection

Technical summary

Smart Manager is a WordPress and WooCommerce bulk-editing plugin. It uses a request parameter in an SQL statement without sanitising or escaping it first.

The published vector puts privileges required at high: the issue is reachable from an administrator-level account. That still matters, because it turns a restricted administrative interface into arbitrary database access and widens the blast radius of any single compromised or over-provisioned admin login.

Impact

Arbitrary read and write access to the WordPress database from an administrative account, beyond the operations the plugin interface exposes.

The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Remediation

WPScan records the issue as fixed in Smart Manager 8.28.0.

Disclosure timeline

1. 2024-01-18WPScan advisory published
2. 2024-02-12CVE record published

Only publicly documented dates are shown. Where a step in the process was not published, it is not listed.

References

• NVD entry
• CVE record (MITRE)
• WPScan advisory

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.