{
 "id": "WPSEC-2026-0900",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0900/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0900/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0900/index.md",
 "title": "Personio Integration Light <= 5.7.1 - Authenticated (Position Manager+) SQL Injection via Backend Position Search",
 "description": "The Personio Integration Light plugin for WordPress is vulnerable to SQL Injection via the search term of the backend list of positions in all versions up to, and including, 5.7.1, due to the user-supplied search term being concatenated directly into SQL LIKE clauses in the search_also_in_meta_fields() posts_search filter. The term is escaped only with esc_like(), which does not escape quotes and turns WordPress's added slashes into escaped backslashes, and $wpdb->prepare() is not used. This makes it possible for authenticated attackers with the plugin's 'Manage Personio-based Positions' role (read_personioposition capability) or higher to append additional SQL to existing queries and extract sensitive information, such as password hashes, from the database.",
 "plugin": {
  "slug": "personio-integration-light",
  "name": "Personio Integration Light",
  "full_name": "Personio Integration Light",
  "wordpress_org": "https://wordpress.org/plugins/personio-integration-light/",
  "advisories_url": "https://wpsec.com/vuln/plugin/personio-integration-light/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/personio-integration-light"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.0.0",
 "remediation": "Update to 6.0.0 or later.",
 "fix_released": "2026-10-13T12:33:35+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:18:25.953974+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0900/",
  "https://plugins.svn.wordpress.org/personio-integration-light/tags/6.0.0/",
  "https://wordpress.org/plugins/personio-integration-light/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/personio-integration-light",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}