Multiple SQL Injection Vulnerabilities
Due to insufficient input validation in certain functions of WordPress it is possible for a user with the 'Editor' role to inject arbitrary SQL commands. By exploiting this vulnerability, an attacker gains access to all records stored in the database with the privileges of the WordPress database user. Proof of concept: 1) The get_terms() filter declared in the wp-includes/taxonomy.php file does not properly validate user input, allowing an attacker with 'Editor' privileges to inject arbitrary SQL commands in the 'orderby' and 'order' parameters passed as array members to the vulnerable filter when sorting for example link categories. 2) The get_pages() filter declared in the wp-includes/post.php file does not properly validate user input, allowing an attacker with 'Editor' privileges to inject arbitrary SQL commands in the 'sort_column' and 'sort_order' parameters passed as array members to the vulnerable filter when sorting for example pages. 3) The get_users() filter declared in the wp-includes/user.php file does not properly validate user input, allowing an attacker with 'Editor' privileges to inject arbitrary SQL commands in the 'orderby' and 'order' parameters passed as array members to the vulnerable filter when sorting for example users.
