CVE-2023-27605
📋 TL;DR
This SQL injection vulnerability in the WP Reroute Email WordPress plugin allows attackers to execute arbitrary SQL commands. It affects all WordPress sites using vulnerable versions of the plugin, potentially compromising the entire database.
💻 Affected Systems
- WP Reroute Email WordPress Plugin
📦 What is this software?
Wp Reroute Email by Wp Reroute Email Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and full site takeover
Likely Case
Unauthorized data access, modification of database content, and potential administrative access
If Mitigated
Limited impact if proper input validation and database permissions are enforced
🎯 Exploit Status
Requires admin-level access to exploit according to references
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.7 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/wp-reroute-email/wordpress-wp-reroute-email-plugin-1-4-6-admin-sql-injection-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Reroute Email
4. Click 'Update Now' if available
5. If no update available, deactivate and delete the plugin
🔧 Temporary Workarounds
Immediate Plugin Deactivation
allDisable the vulnerable plugin to prevent exploitation
wp plugin deactivate wp-reroute-email
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries
- Apply web application firewall rules to block SQL injection patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WP Reroute Email versionCheck Version:
wp plugin get wp-reroute-email --field=versionVerify Fix Applied:
Verify plugin version is 1.4.7 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by plugin access
Network Indicators:
- HTTP POST requests to wp-admin with SQL patterns in parameters
SIEM Query:
SELECT * FROM web_logs WHERE uri LIKE '%wp-reroute-email%' AND (params LIKE '%SELECT%' OR params LIKE '%UNION%' OR params LIKE '%INSERT%')