High Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3684

Unauthenticated SQL injection in a WordPress quote-calculation plugin (historical — fixed)

An audit of older releases found widespread unauthenticated SQL injection, including UNION-capable exfiltration through a public shortcode. The developer fixed the issues in version 2.0.0; this advisory documents the vulnerable code for the record. Details are revealed automatically on the reveal date.

HighFixed in 2.0.0
Summary

a WordPress quote-calculation plugin (versions older releases) processed quote requests and admin actions with no nonces, no capability checks and no $wpdb->prepare() anywhere in its main file — including top-level GET handlers that deleted records and a public shortcode whose rendered output reflected UNION-query results, enabling full database extraction. The developer addressed SQLi/XSS/CSRF in version 2.0.0.

All sites should run 2.0.3 or newer; this page is retained as the historical record of the vulnerable code.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date, then revealed automatically.