High Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3677

Authenticated (any role) SQL injection in a WordPress feed-builder plugin

An AJAX handler accepts every logged-in user without nonce or capability checks and builds unprepared queries from request input and attacker-controllable host headers. On sites with open registration this is effectively unauthenticated. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

HighCoordinated disclosure
Summary

a WordPress feed-builder plugin exposes an AJAX action callable by every logged-in user — no nonce, no capability check. Request parameters pass through sanitize_text_field() only (which preserves single quotes) and are concatenated into $wpdb->query() INSERT statements without prepare(); the Host header is used as secondary injection channel. The affected release is all current versions.

No fixed version exists. Site owners should temporarily deactivate the plugin.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.