CVE-2026-18752 Overview
The Persistent Login plugin for WordPress contains a SQL Injection vulnerability in versions up to and including 3.1.0. The flaw resides in the handling of the wppl_device_id cookie, which is passed into a database query without sufficient escaping or query preparation. Authenticated users with subscriber-level access or above can append arbitrary SQL statements to the existing query and extract sensitive data from the WordPress database. Exploitation requires the plugin's Login History feature to be enabled. The issue is tracked as CWE-89: SQL Injection.
Critical Impact
Authenticated subscribers can exfiltrate arbitrary database contents, including user credentials and password hashes, from affected WordPress installations.
Affected Products
- Persistent Login plugin for WordPress, all versions up to and including 3.1.0
- WordPress sites with the plugin's Login History feature enabled
- Sites permitting subscriber-level (or higher) account registration
Discovery Timeline
- 2026-09-01 - CVE-2026-18752 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-18752
Vulnerability Analysis
The vulnerability is a generic SQL Injection reachable through the wppl_device_id cookie processed by the plugin's Login History subsystem. An authenticated attacker with at least subscriber privileges submits a crafted cookie value that is concatenated into a SQL statement without parameterization. The database executes the appended SQL, returning attacker-selected data through the plugin's query path. Because the injection point sits in cookie handling rather than a POST parameter, standard input filters focused on request bodies may miss the payload. The impact is limited to confidentiality: successful exploitation exposes arbitrary tables, including wp_users credential material, but does not modify data or affect availability directly.
Root Cause
Two defects combine to produce the flaw. First, the plugin fails to escape or sanitize the wppl_device_id cookie value before use. Second, the underlying SQL query is constructed via string concatenation rather than $wpdb->prepare() with placeholders. Relevant sink and source locations are visible in the plugin source and the cookie ingestion path.
Attack Vector
The attacker registers or authenticates as a subscriber, then issues an HTTP request to any endpoint that triggers Login History processing while supplying a malicious wppl_device_id cookie. The injected SQL executes with the privileges of the WordPress database user, typically full read access to all site tables. Exploitation requires network access to the site and the Login History feature to be enabled in plugin settings. See the Wordfence Vulnerability Report for additional technical context.
No verified exploit code is publicly available at the time of publication. Refer to the linked references above for technical details of the injection sink.
Detection Methods for CVE-2026-18752
Indicators of Compromise
- HTTP requests containing SQL syntax such as UNION SELECT, SLEEP(, or comment tokens (--, #) inside the wppl_device_id cookie header
- Anomalously long or non-hexadecimal wppl_device_id cookie values from authenticated subscriber accounts
- Web server or WAF logs showing subscriber-authenticated sessions issuing repeated requests with varying cookie payloads consistent with blind SQL injection probing
Detection Strategies
- Inspect access logs for the wppl_device_id cookie and flag values containing SQL keywords, quotes, or boolean tautologies
- Enable database query logging or wpdb error surfacing to catch malformed queries generated by injection attempts
- Correlate low-privilege user sessions with unusually high database read volumes or slow queries
Monitoring Recommendations
- Deploy a WordPress-aware web application firewall with rules covering cookie-based SQL injection payloads
- Alert on newly registered subscriber accounts that immediately access authenticated endpoints tied to wp-persistent-login
- Retain WordPress and reverse proxy logs long enough to reconstruct exfiltration attempts observed after disclosure
How to Mitigate CVE-2026-18752
Immediate Actions Required
- Update the Persistent Login plugin to the patched release published in the WordPress plugin changeset
- If patching is not immediately feasible, disable the Login History feature in the plugin settings to remove the exploitable code path
- Audit WordPress user accounts and remove untrusted subscriber-level registrations
- Rotate WordPress secrets in wp-config.php and force password resets if compromise is suspected
Patch Information
The vendor addressed the vulnerability in the release referenced by WordPress plugin changeset 3648199. Site administrators should upgrade beyond version 3.1.0 to the fixed release. Confirm the installed version through the WordPress admin plugins page after updating.
Workarounds
- Disable the Login History feature until the plugin is updated, which removes the vulnerable query path
- Restrict subscriber account self-registration by setting Anyone can register to off under Settings > General
- Deploy WAF rules that reject wppl_device_id cookie values not matching the expected device identifier format
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
