WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

The SQL Injection vulnerability in Coven Core allows an attacker to bypass security measures and directly manipulate database queries. Because it's a blind SQL injection, the attacker doesn't receive immediate feedback from the database; instead, they infer information through time-based or boolean-based responses. This makes exploitation more challenging but still feasible. Successful exploitation could lead to unauthorized access to sensitive user data, configuration details, or even complete database compromise. The attacker could potentially modify data, delete records, or gain control over the WordPress site. While no direct precedent is immediately obvious, blind SQL injection vulnerabilities are frequently exploited in WordPress plugins, highlighting the potential for widespread impact.

WordPress sites utilizing the Coven Core plugin, particularly those with sensitive data stored in the database, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others. Sites using older, unpatched versions of WordPress or with weak security configurations are also at increased risk.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/coven-core/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/coven-core/ | grep SQL

• wordpress / composer / npm:

wp plugin list | grep coven-core

• wordpress / composer / npm:

wp plugin status coven-core

1. 2026-02-20Disclosure

   disclosure

1. Reserviert2025-12-31
2. Veröffentlicht2026-02-20
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

Given that a patch is not yet available, immediate mitigation steps are crucial. First, consider temporarily disabling the Coven Core plugin to prevent potential exploitation. If disabling is not feasible, implement a Web Application Firewall (WAF) rule to filter SQL injection attempts targeting the vulnerable endpoints. Specifically, look for unusual characters and patterns commonly used in SQL injection payloads. Carefully review any custom code interacting with the database to ensure proper input sanitization and parameterized queries. Monitor WordPress access logs for suspicious activity, particularly requests containing SQL-like syntax. After a patched version is released, upgrade immediately and verify the fix by attempting a known SQL injection payload against the vulnerable endpoint to confirm it is no longer exploitable.