Critical Security Advisory Disclosed 2026-10-26 · 11:12 UTC
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3676

SQL injection in two WordPress admin plugins by the same author (a contact form and an invoicing plugin) — including unauthenticated sinks

Two plugins from the same author share the same defect pattern: request input flows into unprepared database queries. The contact-form plugin executes INSERT statements on every page load without any authentication. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

CriticalCoordinated disclosure
Summary

two WordPress admin plugins by the same author (a contact form and an invoicing plugin) both build $wpdb queries by concatenating request input without prepare(). In the contact-form plugin the vulnerable files are included top-level, so the INSERT sinks run on every request without any authentication. The invoicing plugin exposes authenticated sinks without nonces (CSRF-able). The affected releases are all current versions.

No fixed versions exist. Site owners should deactivate both plugins.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.