A SQL Injection vulnerability has been identified in the WordPress History Log by click5 Plugin. This vulnerability could allow a malicious actor to directly interact with your database, including but not limited to stealing information.

This vulnerability was discovered and responsibly reported by Karolis Narvilas.

The vulnerability is an SQL Injection vulnerability that occurs in the history-log-by-click5.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious SQL code into the database.

Severity:

The vulnerability has a CVSS 3.1 score of 7.6, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

The critical SQL Injection vulnerability has been addressed in the latest available version of the History Log by click5 Plugin, specifically in version 1.0.13.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Steal information from databases, such as user information, credit card information, and other sensitive data.
  • Modify or delete data in the database.
  • Disable website or database.
  • Take complete control of the website and database.

Recommendation:

Given the severity of this vulnerability, we strongly advise immediate action to protect the WordPress website:

  1. Update the Plugin: Users of the History Log by click5 Plugin are strongly advised to update to the latest available version (at least 1.0.13) as soon as possible. This vulnerability has been fixed in version 1.0.13.
  2. Regular Plugin Updates: Beyond this particular update, it is wise to establish a practice of regularly updating all WordPress plugins and themes to their latest versions. Keeping website components up-to-date is a fundamental security measure.
  3. Enhance Security Measures: Consider implementing additional security measures, such as web application firewalls (WAFs), robust authentication protocols, and routine security audits. A comprehensive security strategy is vital to minimize the risk of exploitation attempts.