Critical Unauthenticated SQLi & Broken Access Control Flaws Expose Thousands of WordPress Sites—Patch Now + Video

By /

Listen to this Post

Featured Image
Introduction: Three critical security vulnerabilities have been publicly disclosed in popular WordPress plugins, putting thousands of websites at risk of full database compromise and administrative takeover. Discovered and reported by security researcher Martín Martín, these flaws include an unauthenticated SQL injection (CVE-2026-39531) with a CVSS score of 9.3 and two unauthenticated broken access control (BAC) vulnerabilities (CVE-2026-39513 and CVE-2026-39534) scoring 7.5, all of which require immediate patching.

Learning Objectives:

  • Understand the technical mechanics of unauthenticated SQL injection and broken access control vulnerabilities in WordPress plugins.
  • Learn how to detect vulnerable versions of WP Directory Kit and Easy Appointments plugins using automated scanners and manual checks.
  • Implement step-by-step mitigation and hardening strategies, including patching, WAF rules, and secure coding practices.
  1. CVE-2026-39531: Unauthenticated SQL Injection in WP Directory Kit

This critical vulnerability stems from insufficient escaping on user-supplied parameters and lack of preparation on existing SQL queries within the WP Directory Kit plugin, affecting all versions up to 1.5.0. The issue resides in the `select_2_ajax()` function, which fails to sanitize the `columns_search` parameter, allowing unauthenticated attackers to append arbitrary SQL queries.

Step‑by‑Step Guide to Detect and Exploit (Educational Use Only):

  1. Identify Vulnerable Version: Use `wpscan` or `nmap` with the `http-wordpress-plugins` script to enumerate plugin versions. 
    wpscan --url https://target-site.com --enumerate vp --plugins-detection aggressive

  2. Manual Parameter Fuzzing: Intercept a request to the `select_2_ajax()` endpoint and inject a single quote (') into the `columns_search` parameter.

    POST /wp-admin/admin-ajax.php HTTP/1.1
action=select_2_ajax&columns_search=test'

  3. Confirm Injection: A SQL error in the response confirms the vulnerability.

  4. Extract Data (Conceptual): Using a UNION-based payload to retrieve usernames and password hashes.

    ' UNION SELECT user_login, user_pass FROM wp_users WHERE '1'='1

  5. Mitigation: Immediately update the plugin to version 1.5.1 or later. If updating is impossible, implement a Web Application Firewall (WAF) rule to block requests containing SQL patterns (e.g., UNION, SELECT, --) to the `admin-ajax.php` endpoint.

  6. CVE-2026-39513: Unauthenticated Broken Access Control in Easy Appointments

This vulnerability allows unauthenticated attackers to bypass authorization checks and perform privileged actions, such as creating admin accounts or modifying system settings. The flaw arises because the plugin’s CSRF verification only applies to POST requests, leaving GET endpoints unprotected.

Step‑by‑Step Guide to Detect and Mitigate:

  1. Detect Plugin Version: Check the readme file or use wpscan. 
    curl -s https://target-site.com/wp-content/plugins/easy-appointments/readme.txt | grep "Stable tag"

  2. Verify the Flaw: Attempt to access a privileged endpoint, such as user creation, using a GET request.

    GET /wp-admin/admin-ajax.php?action=ea_create_admin&username=attacker&[email protected]&role=administrator HTTP/1.1

  3. Exploit (Proof of Concept): If the endpoint accepts GET requests, an attacker can craft a malicious link or use CSRF to trick an admin into executing the action.

  4. Mitigation: Update the Easy Appointments plugin to version 3.12.22 or later. If patching is delayed, implement strict referrer and origin checks, and consider using a WAF to block suspicious GET requests to admin-ajax.php.

  5. CVE-2026-39534: Unauthenticated Broken Access Control in WP Directory Kit

Similar to CVE-2026-39513, this vulnerability in the WP Directory Kit plugin fails to implement proper capability checks on AJAX functions, allowing unauthenticated users to perform sensitive operations. Specifically, the `wdk_generate_auto_login_link` function uses a cryptographically weak token generation mechanism, enabling attackers to predict login tokens and escalate privileges.

Step‑by‑Step Guide to Detect and Harden:

  1. Check for Weak Token Generation: Analyze the plugin’s source code for the `wdk_generate_auto_login_link` function. If it uses a weak random number generator (e.g., `rand()` or mt_rand()), it is vulnerable.

  2. Simulate Token Prediction (Conceptual): If the token is based on a timestamp or a predictable sequence, an attacker can brute-force the token.

    Pseudocode for token brute-force
for i in range(1000000):
token = generate_weak_token(i)
if login_with_token(token):
print(f"Valid token found: {token}")
break

  3. Verify Exploit: Access the auto-login endpoint with a predicted token.

    GET /?wdk_auto_login=predicted_token

  4. Mitigation: Update the plugin to version 1.5.1 or later. Additionally, implement two-factor authentication (2FA) for all administrative accounts to mitigate token-based bypasses. Regularly audit user sessions and revoke suspicious tokens.

4. Cloud Hardening & Continuous Monitoring

Beyond patching, a proactive defense strategy is essential. Implement cloud hardening measures such as restricting access to `admin-ajax.php` and other sensitive endpoints using a Web Application Firewall (WAF) like Cloudflare or ModSecurity. Use security information and event management (SIEM) tools to monitor for SQL injection patterns and abnormal access requests.

Linux Command to Monitor for SQLi Attempts:

sudo tail -f /var/log/apache2/access.log | grep -E "(UNION|SELECT|DROP|--|%27)"

Windows PowerShell Command to Monitor for BAC Attempts:

Get-Content "C:\inetpub\logs\LogFiles\W3SVC1\u_ex.log" -Wait | Select-String "admin-ajax.php"

5. Training & AI-Powered Security

Organizations should invest in cybersecurity training for developers and system administrators to prevent similar vulnerabilities. Focus on secure coding practices, such as prepared statements and proper capability checks. Leverage AI-powered security tools to automatically scan for zero-day vulnerabilities and anomalous behavior. Tools like Patchstack offer virtual patching for unpatched plugins, while AI-based WAFs can detect and block novel attack patterns.

What Undercode Say

  • Immediate Patching is Critical: The disclosed CVEs are actively being exploited in the wild. Delaying updates could lead to complete site takeover and data breaches.
  • Proactive Defense Wins: Combine patching with WAF rules, endpoint monitoring, and security training to build a resilient security posture.
  • Automated Scanners are Your Friend: Use tools like wpscan, nmap, and SIEM solutions to continuously monitor for vulnerable components and attack attempts.

Prediction: The increasing reliance on third-party plugins in WordPress will continue to be a primary attack vector. We predict a rise in automated, AI-driven attacks that can discover and exploit such vulnerabilities within hours of disclosure. Organizations must adopt a “shift-left” security approach, integrating vulnerability scanning and secure coding practices early in the development lifecycle. Failure to do so will result in a surge of supply-chain attacks, where a single vulnerable plugin compromises thousands of websites simultaneously.

▶️ Related Video (80% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Martinmarting 3 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: