# Personio Integration Light <= 5.7.1 - Authenticated (Position Manager+) SQL Injection via Backend Position Search

- **ID:** WPSEC-2026-0900
- **Plugin:** Personio Integration Light (`personio-integration-light`), https://wordpress.org/plugins/personio-integration-light/
- **Affected versions:** all versions before 6.0.0
- **Fixed in:** 6.0.0 (Update to 6.0.0 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/personio-integration-light
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0900/

## Description

The Personio Integration Light plugin for WordPress is vulnerable to SQL Injection via the search term of the backend list of positions in all versions up to, and including, 5.7.1, due to the user-supplied search term being concatenated directly into SQL LIKE clauses in the search_also_in_meta_fields() posts_search filter. The term is escaped only with esc_like(), which does not escape quotes and turns WordPress's added slashes into escaped backslashes, and $wpdb->prepare() is not used. This makes it possible for authenticated attackers with the plugin's 'Manage Personio-based Positions' role (read_personioposition capability) or higher to append additional SQL to existing queries and extract sensitive information, such as password hashes, from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-0900/
- https://plugins.svn.wordpress.org/personio-integration-light/tags/6.0.0/
- https://wordpress.org/plugins/personio-integration-light/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0900/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.