WordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability

Successful exploitation of this SQL Injection vulnerability could grant an attacker complete control over the WordPress database. They could extract sensitive user data (usernames, passwords, email addresses), modify existing data, or even delete entire tables. The impact extends beyond data theft; an attacker could potentially use the compromised database to gain a foothold on the entire WordPress server, leading to further attacks and system compromise. This vulnerability resembles other SQL Injection attacks where attackers leverage database queries to bypass security controls and access restricted information.

WordPress websites utilizing the Modal Survey plugin, particularly those running older versions (0.0.0–2.0.2.0.1), are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others. Sites with weak database user permissions are also at increased risk.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/modal-survey/

• generic web:

curl -I 'https://your-wordpress-site.com/wp-content/plugins/modal-survey/endpoint.php?param='; # Check for SQL injection indicators in response headers

1. 2025-04-18Disclosure

   disclosure

1. Reserviert2025-04-16
2. Veröffentlicht2025-04-18
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the Modal Survey plugin to version 2.0.3 or later. If an upgrade is not feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL queries targeting the vulnerable endpoints. Specifically, look for patterns indicative of SQL injection attempts, such as the use of single quotes, double quotes, semicolons, or SQL keywords. Additionally, review and restrict database user permissions to limit the potential damage from a successful attack. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is blocked.