SQL Injection Vulnerability in Podlove Subscribe Button Plugin

CVE-2024-1118

Summary

The Podlove Subscribe Button Plugin for WordPress is exposed to a vulnerability that allows for UNION-based SQL Injection attacks via the 'button' attribute in the podlove-subscribe-button shortcode. This security flaw results from inadequate escaping of the user-supplied input, combined with insufficient preparation of existing SQL queries. As a result, authenticated attackers with contributor-level access can inject additional SQL queries into those already present. This behavior poses a significant risk, enabling potential extraction of sensitive data from the database.

References