CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.
AnalysisAI
SQL injection in the B1.lt WordPress plugin (versions ≤2.2.57) allows authenticated users with Subscriber-level privileges to execute arbitrary database commands via the b1_run_query AJAX action. The vulnerability stems from a missing capability check (CWE-862), enabling low-privileged authenticated attackers to access database functionality normally restricted to administrators. With CVSS 8.8 (network-accessible, low complexity, high impact on confidentiality/integrity/availability) and successful exploitation requiring only subscriber credentials, this represents a critical privilege escalation vector. No public exploit identified at time of analysis, though the technical details disclosed increase weaponization risk.
Technical ContextAI
This vulnerability exploits WordPress's AJAX action handler mechanism. The B1.lt plugin registers an AJAX endpoint (b1_run_query) that directly executes SQL queries against the WordPress database without validating whether the authenticated user has administrative privileges. The root cause is CWE-862 (Missing Authorization), where the plugin fails to implement WordPress's capability checking functions (like current_user_can) before processing database operations. WordPress operates on a role-based access control model where Subscribers (the lowest authenticated role) typically have minimal permissions. This flaw bypasses that security boundary, allowing any authenticated user to invoke database query functionality. The CVSS vector PR:L confirms low-privileged authentication is required, while AV:N/AC:L indicates network-accessible exploitation with minimal complexity. The plugin appears to be B1 Accounting integration software for WordPress, exposing database operations through insufficiently protected AJAX handlers.
Affected ProductsAI
The B1.lt (B1 Accounting) plugin for WordPress is affected in all versions up to and including 2.2.57. This plugin integrates B1 accounting software with WordPress installations and is available through the official WordPress plugin repository at wordpress.org/plugins/b1-accounting. The vulnerability impacts any WordPress site running the affected plugin versions where authenticated user registration is enabled or where attacker-controlled Subscriber accounts exist. Based on the WordPress Trac references, the vendor has committed fixes in changesets 3329617 and 3338792, indicating patches have been developed for the vulnerable code paths.
RemediationAI
Immediately update the B1.lt plugin to version 2.2.58 or later, which addresses the missing capability check vulnerability. The vendor has released fixes documented in WordPress plugin repository changesets 3329617 and 3338792 available at plugins.trac.wordpress.org. Site administrators should verify the installed plugin version via WordPress admin dashboard and apply updates through the standard WordPress plugin update mechanism. As interim mitigation if patching is delayed, restrict user registration to prevent attacker-controlled Subscriber account creation, audit existing low-privileged user accounts for suspicious activity, review database logs for unauthorized SQL execution patterns, and consider temporarily disabling the B1.lt plugin if not actively required for business operations. Post-remediation, conduct database integrity checks to ensure no unauthorized modifications occurred during the vulnerability window. Additional security guidance is available from Wordfence Threat Intelligence at wordfence.com/threat-intel/vulnerabilities/id/4e479a3f-ef1a-4476-89e1-86d0f388f2c3.
Share
External POC / Exploit Code
Leaving vuln.today