⛔ High Security Advisory WP Page Extension · WordPress.org · 1.1 Disclosed 2026-07-11 · 14:45 UTC

Coordinated disclosure — technical detail withheld until 2026-08-25 (45 days). The affected package, version, vulnerability class and remediation are public on this page so defenders can act now. The exact code location, sink and reproduction are held back to limit exploitation until the window closes, then revealed automatically. Vendor notified 2026-07-11.

Advisory · CLR-2026-3030

SQL Injection in the WordPress plugin WP Page Extension (1.1)

WP Page Extension (WordPress.org, version 1.1) WP Page Extension (1.1) hooks every post-save with no nonce, capability, or autosave check and passes a POST field directly into a SQL statement with no sanitisation. Any authenticated user who can create a post (Contributor and above) can inject SQL and read or modify arbitrary database contents; the missing nonce also makes it CSRF-able. The plugin has been unmaintained since August 2012; no fixed release exists — remove it.

HighSQL InjectionAuthenticated (Contributor+)WordPressVerified in source

Summary

WP Page Extension 1.1 (WordPress.org) contains an authenticated (Contributor+) sql injection. The plugin registers a handler reachable by any authenticated user (Contributor+), and it concatenates a request parameter straight into a live SQL statement.

The handler runs on every post-save with no nonce, capability, or autosave check, and passes a POST field directly into a SQL statement with no sanitisation, integer cast, or prepared statement. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

WP Page Extension was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 1.1 artifact. The plugin has not been updated since 2012-08-29; because no patched release exists, the correct remediation is to remove it.

Impact

Class: SQL Injection (CWE-89). Privilege required: a low-privileged (Contributor+) account. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code

🔒

Technical detail withheld until 2026-08-25 (45 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Technical detail

🔒

Timeline

—

Published

WP Page Extension listed on WordPress.org; last updated 2012-08-29, unmaintained since.

2026-07-11

Automatic detection

codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.

2026-07-11

Manual verification

Confirmed against the shipped 1.1 artifact.

2026-07-11
4:45 UTC

WordPress Plugin Security Team notified

Coordinated disclosure opened with full technical detail; a 45-day window begins.

2026-08-25

Technical-detail reveal

The exact code location and reproduction are published automatically after the 45-day window.

Indicators & characteristics

PKGWP Page Extension 1.1 (WordPress.org) — wordpress.org/plugins/wp-page-extension

SHA25639bf0862e643109c0251bddcc53501af143618465f64dff58f059c12d0866dcf (artifact)

CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser

AUTHZAny logged-in user (Contributor+) · no nonce · no capability check

🔒SINK — withheld until 2026-08-25

🔒ENTRY — withheld until 2026-08-25

Remediation

#	Action	Priority
01	Deactivate and delete WP Page Extension. No patched release exists and it is abandoned; sites should not run version 1.1.	Critical
02	Patch: replace every concatenated query with `$wpdb->prepare()` and typed placeholders (`%d`/`%s`).	High
03	Add nonce + capability checks (`check_ajax_referer()`, `current_user_can()`) to state-changing AJAX handlers and remove any unintended `nopriv` registration.	High
04	Check access logs for requests with SQL metacharacters in parameters during the exposure window.	Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.