Personio Integration Light <= 5.7.1 - Authenticated (Position Manager+) SQL Injection via Backend Position Search
- ID
- WPSEC-2026-0900
- Plugin
- Personio Integration Light (personio-integration-light)
- Affected
- all versions before 6.0.0
- Remediation
- Update to 6.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Personio Integration Light on WPSec AttackSurface
- Fix released
- Published
Description
The Personio Integration Light plugin for WordPress is vulnerable to SQL Injection via the search term of the backend list of positions in all versions up to, and including, 5.7.1, due to the user-supplied search term being concatenated directly into SQL LIKE clauses in the search_also_in_meta_fields() posts_search filter. The term is escaped only with esc_like(), which does not escape quotes and turns WordPress's added slashes into escaped backslashes, and $wpdb->prepare() is not used. This makes it possible for authenticated attackers with the plugin's 'Manage Personio-based Positions' role (read_personioposition capability) or higher to append additional SQL to existing queries and extract sensitive information, such as password hashes, from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0900/
- https://plugins.svn.wordpress.org/personio-integration-light/tags/6.0.0/
- https://wordpress.org/plugins/personio-integration-light/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS