05 / WEB APPLICATION SECURITY
WordPress SQL Injection via REST API
Assessed a deliberately vulnerable WordPress installation and confirmed unauthenticated SQL injection in the wp-google-maps REST API, followed by database enumeration and credential recovery.
Lab environment
HF2019-Linux vulnerable machine (192.168.56.106), Ubuntu 24.04 Attackbox (192.168.56.104), Host-only vboxnet0.
Assessment highlights
- Enumerated FTP, SSH, HTTP and Webmin services.
- Nikto and WPScan confirmed WordPress and the wp-google-maps plugin.
- Boolean tests using the REST API demonstrated that the fields parameter was being incorporated into SQL.
- Database and WordPress table information was enumerated through the vulnerable endpoint.
- A WordPress administrator password hash was recovered and cracked in the lab, leading to confirmed administrator access.
Security impact
The report demonstrates how an unauthenticated SQL injection can progress from data disclosure to credential compromise and application administrator access.
Recommendations
- Update or remove the vulnerable plugin.
- Use parameterized/prepared SQL queries.
- Strictly allowlist fields accepted by REST API parameters.
- Require authentication where public access is unnecessary.
- Enforce strong passwords and modern password hashing.
- Monitor REST API requests for SQL-injection patterns.
Lab scope: This case study describes coursework performed against intentionally vulnerable systems in an isolated environment.