An SQL Injection bug was found on the Ally plug-in hitting the website.

An SQL Injection bug was found on the Ally plug-in, hitting over 4 lakh Wordpress websites.

Shooting SQL or SQL Injection code is known as a classic website hacking method that, even after decades, still has a vulnerability for hackers to use.

According to a report by the website Security Affair, a security vulnerability has been detected on a Wordpress plug-in called Ally (also known as One Click Accessibility). This add-in was originally intended to create a website for people with disabilities to use. This plug-in has a lot of features, including a Scanner, a Scanner for people with disabilities to use with AI recommendations, a lot of useful widgets, etc. This plug-in is very popular with up to 4 active websites. Hundred thousand websites.

But in February, a researcher from Acquia, a cloud services company, detected a CVE-2026-2413 vulnerability (with a CVSS score of 7.5). This vulnerability is an insecure handling vulnerability in the Subscribers Query section. The plug-in creates an SQL JOIN query with the URL Parameter of the page but does not use Wordpress's wpdb- > prepare () function. This function acts to avoid special characters and a meter. With Query, even if using the esc _ url _ raw () function, it will not be able to prevent SQL Injection, leading to the use of SQL Injection to steal data from the database on the website.

But the good news is that this vulnerability was quickly patched after Wordfence, a security plugin developer on the Wordpress website, organized the Wordfence Bug Bounty Program for bug hunting and received such bug reports from the researchers, as well as a reward for this bug of US $800 (26,143.60 baht), immediately reported it to Elementor, the developer of the plugin, on February 13. The development team responded on the 15th and released the patch on the 23rd in the same month.

This vulnerability will affect all versions of the Ally plug-in up to 4.0.3. Users can plug this vulnerability only by upgrading it to version 4.1.0. Therefore, ask the administrator of the website that uses the plug-in to update it to the latest version immediately.

# Trending # lemon 8 diary # Drug sign with lemon8 # sqlinjection # freedomhack