SQL injection
3 articles with this tag
CVE-2026-63030 / CVE-2026-60137 — Unauthenticated SQLi to RCE in WordPress core (explainer & fixes)
A REST API batch-endpoint route-confusion flaw in WordPress core (CVE-2026-63030, CWE-436) chains with the WP_Query author__not_in SQL injection (CVE-2026-60137, CWE-89) to reach unauthenticated SQLi → RCE (CVSS 9.8, in CISA KEV). Both are fixed in the same release. The real fix is updating core to 6.8.6 / 6.9.5 / 7.0.2, plus a compromise check. WordPress is core software with an enormous install base, so updating is the top priority.
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
What is SQL injection (SQLi) — when input rewrites your database's commands
SQLi is when input is read as 'part of the command' rather than data, changing a query's meaning — straight to read/alter/delete. The real defense is to stop string-concatenating SQL and pass values via placeholders (prepared statements).