Critical Security Advisory Disclosed 2026-10-26 · 11:12 UTC
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3679

Unauthenticated SQL injection and account takeover in a WordPress agenda-management add-on for Toastmasters clubs

An unauthenticated SQL-injection in a REST-API permission check lets any visitor resolve an arbitrary user ID and impersonate that account — full auth bypass. Confirmed in the latest release. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

CriticalCoordinated disclosure
Summary

a WordPress agenda-management add-on for Toastmasters clubs exposes an unauthenticated REST route whose permission callback checks a caller-supplied mobile key via an unprepared SQL query. The key value is only passed through sanitize_text_field(), which does not stop SQL injection — a crafted value makes the query return an arbitrary user ID, and the plugin then calls wp_set_current_user() with it. Any anonymous visitor can impersonate any account, including administrators. Confirmed in current releases incl. latest.

Until a fix ships, site owners should deactivate the plugin.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.