Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-3811: Oturia plugin lets attackers run database commands

CVE-2018-3811 · published 8 years ago

Summary

The Oturia Smart Google Code Inserter plugin for WordPress (versions before 3.5) can be tricked by anyone on the internet into running database commands on your server. This could let an attacker view, change, or delete your site data. Install the latest version of the plugin or remove it if you cannot update.

What to do

Update oturia smart_google_code_inserter to version 3.5 or later.

Affected software

Vendor	Product	Affected versions
oturia	smart_google_code_inserter	< 3.5 `cpe:2.3:a:oturia:smart_google_code_inserter::::::wordpress::*`

Original advisory text

SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.

References

https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html Exploit Third Party Advisory
https://wordpress.org/plugins/smart-google-code-inserter/#developers Release Notes Third Party Advisory
https://wpvulndb.com/vulnerabilities/8988 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/43420/ Exploit Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

42% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published1 Jan 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-3811 · NVD

Track software like this

Free during beta