Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection via 'shortcode_data' Parameter Keys
- ID
- WPSEC-2026-0324
- Plugin
- Image Optimizer, Resizer and CDN – Sirv (sirv)
- Affected
- all versions before 8.2.6
- Remediation
- Update to 8.2.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-89
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Sirv on WPSec AttackSurface
- Fix released
- Published
Description
The Sirv plugin for WordPress is vulnerable to SQL Injection via the array keys of the 'shortcode_data' parameter in the sirv_save_shortcode_in_db and sirv_update_sc AJAX actions in all versions up to, and including, 8.2.5. The keys were passed unfiltered to $wpdb->insert() and $wpdb->update(), which use them as SQL column names without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject SQL into these queries, extract sensitive information from the database, and write arbitrary unsanitized values into the plugin's shortcode table, including serialized PHP objects that the plugin then passed to unserialize() when a shortcode was loaded or rendered.
References
- https://wpsec.com/vuln/WPSEC-2026-0324/
- https://plugins.svn.wordpress.org/sirv/tags/8.2.6/
- https://wordpress.org/plugins/sirv/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS