⛔ High Security Advisory WP Page Extension · WordPress.org · 1.1 Disclosed 2026-07-11 · 14:45 UTC

Full technical detail published. The 45-day coordinated-disclosure window (vendor notified 2026-07-11) has passed; the exact code location and analysis are shown below. No weaponised exploit is published.

Advisory · CLR-2026-3030

SQL Injection in the WordPress plugin WP Page Extension (1.1)

WP Page Extension (WordPress.org, version 1.1) WP Page Extension (1.1) hooks every post-save with no nonce, capability, or autosave check and passes a POST field directly into a SQL statement with no sanitisation. Any authenticated user who can create a post (Contributor and above) can inject SQL and read or modify arbitrary database contents; the missing nonce also makes it CSRF-able. The plugin has been unmaintained since August 2012; no fixed release exists — remove it.

HighSQL InjectionAuthenticated (Contributor+)WordPressVerified in source

Summary

WP Page Extension 1.1 (WordPress.org) contains an authenticated (Contributor+) sql injection. The plugin registers a handler reachable by any authenticated user (Contributor+), and it concatenates a request parameter straight into a live SQL statement.

The handler runs on every post-save with no nonce, capability, or autosave check, and passes a POST field directly into a SQL statement with no sanitisation, integer cast, or prepared statement. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

WP Page Extension was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 1.1 artifact. The plugin has not been updated since 2012-08-29; because no patched release exists, the correct remediation is to remove it.

Impact

Class: SQL Injection (CWE-89). Privilege required: a low-privileged (Contributor+) account. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code

 wp-page-extension/wp-page_extension.php ⛔ sql injection 
17add_action('wp_insert_post', [$this,'save_fake_url'], 1, 2);   // fires on every post save
679function save_fake_url($post_id, $post) {
681  extract($_POST); // imports every POST key as a local variable
702  $wpdb->query("UPDATE page_fake_url SET fake_url_code='".$_POST['fake_extension']."' WHERE page_id='".$page_id."'");
705  $wpdb->query('INSERT INTO page_fake_url (page_id,fake_url_code) VALUES ("'.$page_id.'","'.$_POST['fake_extension'].'")');
  }

Technical detail

The handler has no nonce and no capability check, so any logged-in user can reach it. The tainted value lands in the query with no parameterisation.

Further unparameterised queries: the handler also runs extract($_POST), so the post-parent value flows unsanitised into the same query's page_id clause; both the INSERT (line 705) and UPDATE (line 702) paths are affected.

A working proof-of-concept is intentionally not published; the exact reproduction was shared privately with WordPress Plugin Security Team.

Timeline

—

Published

WP Page Extension listed on WordPress.org; last updated 2012-08-29, unmaintained since.

2026-07-11

Automatic detection

codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.

2026-07-11

Manual verification

Confirmed against the shipped 1.1 artifact.

2026-07-11
4:45 UTC

WordPress Plugin Security Team notified

Coordinated disclosure opened with full technical detail; a 45-day window begins.

2026-08-25

Technical-detail reveal

The exact code location and reproduction are published automatically after the 45-day window.

Indicators & characteristics

PKGWP Page Extension 1.1 (WordPress.org) — wordpress.org/plugins/wp-page-extension

SHA25639bf0862e643109c0251bddcc53501af143618465f64dff58f059c12d0866dcf (artifact)

CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser

AUTHZAny logged-in user (Contributor+) · no nonce · no capability check

SINKexact file:line of the injectable sink

ENTRYexact endpoint / action name

Remediation

#	Action	Priority
01	Deactivate and delete WP Page Extension. No patched release exists and it is abandoned; sites should not run version 1.1.	Critical
02	Patch: replace every concatenated query with `$wpdb->prepare()` and typed placeholders (`%d`/`%s`).	High
03	Add nonce + capability checks (`check_ajax_referer()`, `current_user_can()`) to state-changing AJAX handlers and remove any unintended `nopriv` registration.	High
04	Check access logs for requests with SQL metacharacters in parameters during the exposure window.	Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.