CVE-2023-5645
📋 TL;DR
This SQL injection vulnerability in the WP Mail Log WordPress plugin allows attackers with Contributor-level access to execute arbitrary SQL commands on the database. It affects WordPress sites running vulnerable versions of the plugin, potentially leading to data theft, modification, or complete system compromise.
💻 Affected Systems
- WP Mail Log WordPress plugin
📦 What is this software?
Wp Mail Log by Wpvibes
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation to administrator, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, modification of plugin settings or WordPress content, and potential privilege escalation within the WordPress environment.
If Mitigated
Limited impact if proper access controls and input validation are in place, but still poses risk of data leakage from the affected plugin's tables.
🎯 Exploit Status
Exploitation requires Contributor-level WordPress user access. SQL injection techniques are well-documented and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3
Vendor Advisory: https://wpscan.com/vulnerability/e392fb53-66e9-4c43-9e4f-f4ea7c561551
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Mail Log plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.1.3+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
linuxTemporarily disable the WP Mail Log plugin until patched
wp plugin deactivate wp-mail-log
Restrict user roles
allTemporarily remove Contributor role access or limit to trusted users only
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Apply principle of least privilege: review and minimize Contributor-level user accounts
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If WP Mail Log version is below 1.1.3, the system is vulnerable.Check Version:
wp plugin get wp-mail-log --field=versionVerify Fix Applied:
Confirm WP Mail Log plugin version is 1.1.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL errors
- Unexpected database modifications from WordPress users
Network Indicators:
- HTTP POST requests to wp-admin/admin-ajax.php with SQL injection patterns in parameters
SIEM Query:
source="wordpress_logs" AND ("sql syntax" OR "mysql error" OR "wp_mail_log")