CVE-2023-32590 Scanner

The Subscribe to Category plugin is a widely used WordPress extension that enables site owners to send email notifications to subscribers whenever new posts are published in specific categories. It is popular among bloggers, news sites, and content-driven businesses to enhance user engagement and retention. The plugin integrates seamlessly with WordPress's subscription system, allowing administrators to manage notification preferences per category. Its ease of use and effectiveness in driving traffic make it a staple in many WordPress installations, often handling sensitive subscriber data.

CVE-2023-32590 is a critical SQL Injection vulnerability discovered in the Subscribe to Category plugin. It arises from insufficient sanitization of user-supplied input passed to SQL queries, specifically when processing category-related parameters. Attackers can craft malicious input that bypasses the plugin's input validation, allowing arbitrary SQL commands to be executed against the WordPress database. This flaw is particularly dangerous because it does not require authentication, making it exploitable by unauthenticated remote attackers.

The vulnerability exists in the plugin's handling of the 'category' parameter during subscription management. When a user submits a request to subscribe to a category, the plugin fails to properly escape or validate the category ID before incorporating it into a SQL query. An attacker can inject SQL commands by manipulating this parameter, such as appending UNION-based queries to extract data or using boolean-based blind techniques to infer database contents. The vulnerable endpoint is typically accessible via AJAX actions or direct HTTP requests.

Successful exploitation of CVE-2023-32590 can lead to severe consequences, including unauthorized access to the entire WordPress database. Attackers can extract sensitive information like user credentials, email addresses, and session tokens, potentially leading to account takeover. They may also modify or delete database records, causing data integrity loss or denial of service. Given the CVSS score of 9.3, this vulnerability poses a critical risk to any WordPress site using the affected plugin version.