EUVD-2026-28532
GHSA-gpvp-9x48-h5wv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
AnalysisAI
Unauthenticated attackers can exploit SQL injection in OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23 due to improper input sanitization in SQL statement construction. The vulnerability allows remote attackers to extract sensitive data and modify database contents without authentication, though integrity impact is limited. Publicly available exploit code exists, and a patch has been released by the vendor.
Technical ContextAI
OttoKit is a WordPress plugin that automates workflow and task management functions. The vulnerability stems from CWE-89 (SQL Injection), where user-supplied input is incorporated directly into SQL queries without proper escaping or parameterized prepared statements. WordPress plugins using the global WPDB object must properly utilize prepared statements with placeholders (e.g., $wpdb->prepare()) to prevent SQL injection. The plugin fails to sanitize input before constructing SQL statements, allowing attackers to inject arbitrary SQL syntax through HTTP parameters accessible via the plugin's REST API or web-facing functions.
RemediationAI
Vendors and plugin maintainers should update OttoKit to version 1.1.23 or later immediately. WordPress site administrators must update the plugin to the patched version via the WordPress admin dashboard (Plugins → Installed Plugins → OttoKit → Update, or manually via wp-cli: wp plugin update ottokit). As a workaround before patching, disable the affected plugin entirely if it is not mission-critical; this eliminates the attack surface entirely but halts any automation workflows the plugin provides. Additional defensive measures include: restricting REST API access to authenticated users only via web application firewall (WAF) rules or .htaccess rules blocking unauthenticated access to wp-json endpoints, though this may break legitimate integrations. Monitor database query logs for suspicious SQL patterns (UNION SELECT, OR 1=1, comment sequences) to detect active exploitation attempts. Database user privileges should follow the principle of least privilege - the WordPress database user should have SELECT, INSERT, UPDATE, DELETE on wp_* tables only, not CREATE or DROP, to limit the scope of SQL injection impact.
Unauthenticated PHP Object Injection in the OttoKit WordPress plugin (formerly SureTriggers) versions 1.1.27 and earlier
Blind SQL injection in Brainstorm Force OttoKit (WordPress plugin suretriggers) versions up to 1.1.20 allows privileged
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today