The most serious database vulnerability.
WHAT IT IS
An attacker supplying input that becomes part of a query, allowing them to read, change or delete data.
WHY IT HAPPENS
Code that builds queries by concatenating user input into a string.
If a form field's value is placed directly into a query, an attacker controls the query.
THE FIX
Parameterised queries, always. The database receives the query and the values separately, so input can never become instruction.
Every modern framework and application API supports this.
IN WORDPRESS
Use the prepare method on the database object. Never concatenate.
TESTING FOR IT
Enter a single quote character into a form field. A database error in response means the query is not parameterised.
That is a serious finding and needs fixing immediately.
FOR THIRD-PARTY CODE
You cannot audit everything. Keeping plugins and themes updated is the practical defence, since these vulnerabilities are found and patched regularly.
Nulled software is particularly dangerous here, because the modifications frequently introduce exactly this.
WHAT AN INJECTION ACHIEVES
Reading your entire database, including user accounts and customer data.
