Critical Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3681

Unauthenticated SQL injection in a WordPress advertising shortcode plugin — nonce rendered publicly

An unauthenticated AJAX handler builds unprepared SQL from request input. Its nonce check is ineffective because the same nonce is rendered into public pages for every visitor. All reviewed releases are affected. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

CriticalCoordinated disclosure
Summary

a WordPress advertising shortcode plugin serves advertisement content through a wp_ajax_nopriv_ handler that concatenates POST parameters into a $wpdb->get_row() query without prepare(). Although the handler verifies a nonce, that nonce is printed into every page containing the plugin's shortcode — so any anonymous visitor can obtain a valid token and reach the sink. The affected releases are all reviewed releases.

Site owners should deactivate the plugin until a fix ships.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.