High · published October 15, 2025
⚡ An SQL Injection vulnerability lurks in the External Login plugin for WordPress, affecting all versions up to 1.11.2! Just a sneaky ‘log’ parameter can open the door to attackers! 🔥 Think of it like a restaurant where the chef accidentally leaves a back door open—anyone could just waltz in and add their secret sauce to the recipe without anyone checking! An unauthenticated attacker could exploit this vulnerability to inject malicious SQL queries, allowing them to access sensitive information stored in your database. This could lead to data leaks that compromise users' personal information and wreak havoc on your website's integrity.
Think of it like a restaurant where the chef accidentally leaves a back door open—anyone could just waltz in and add their secret sauce to the recipe without anyone checking! This SQL injection vulnerability in the External Login plugin allows attackers to manipulate existing SQL queries through the unvalidated ‘log’ parameter, leading to potential data exposure when using PostgreSQL or MSSQL as the backend.
An unauthenticated attacker could exploit this vulnerability to inject malicious SQL queries, allowing them to access sensitive information stored in your database. This could lead to data leaks that compromise users' personal information and wreak havoc on your website's integrity. Update the External Login plugin to version 1.11.3 or later to close this loophole. Additionally, review your SQL queries for proper parameterization and escaping to prevent future vulnerabilities. Regularly audit your plugins for updates and checks will also keep your site secure. You've got this! Fix this now, and you'll be one step closer to your security hero status! 🛡️