CVE-2018-3811
📋 TL;DR
CVE-2018-3811 is an unauthenticated SQL injection vulnerability in the Oturia Smart Google Code Inserter WordPress plugin. It allows attackers to execute arbitrary SQL queries on the database through the saveGoogleAdWords() function. Any WordPress site running the plugin before version 3.5 is affected.
💻 Affected Systems
- Oturia Smart Google Code Inserter WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, or site takeover.
Likely Case
Data exfiltration, authentication bypass, or modification of site content.
If Mitigated
Limited impact if database permissions are restricted and web application firewall blocks SQL injection patterns.
🎯 Exploit Status
Public exploit code is available and exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5
Vendor Advisory: https://wordpress.org/plugins/smart-google-code-inserter/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Smart Google Code Inserter'. 4. Click 'Update Now' if available, or delete and reinstall version 3.5+. 5. Verify plugin version is 3.5 or higher.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Smart Google Code Inserter plugin until patched.
wp plugin deactivate smart-google-code-inserter
Web Application Firewall rule
allBlock requests containing SQL injection patterns targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Remove the Smart Google Code Inserter plugin completely
- Implement network-level blocking of requests to /wp-admin/admin-ajax.php with suspicious parameters
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Smart Google Code Inserter → Version number. If version is below 3.5, you are vulnerable.Check Version:
wp plugin get smart-google-code-inserter --field=versionVerify Fix Applied:
Confirm plugin version is 3.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=saveGoogleAdWords containing SQL syntax in parameters
- Unusual database queries from web server process
Network Indicators:
- HTTP requests with SQL injection payloads in POST parameters
- Traffic patterns matching known exploit code
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (param="oId" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|create|alter)")🔗 References
- https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html
- https://wordpress.org/plugins/smart-google-code-inserter/#developers
- https://wpvulndb.com/vulnerabilities/8988
- https://www.exploit-db.com/exploits/43420/
- https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html
- https://wordpress.org/plugins/smart-google-code-inserter/#developers
- https://wpvulndb.com/vulnerabilities/8988
- https://www.exploit-db.com/exploits/43420/
