CVE-2026-77824: Media Sweep WordPress Plugin SQLi Vulnerability

CVE-2026-77824 Overview

CVE-2026-77824 is a SQL Injection vulnerability in the Media Sweep – WordPress Media Cleaner plugin for WordPress. The flaw affects all versions up to and including 1.1.3. The plugin fails to properly escape the user-supplied fields parameter and does not adequately prepare the underlying SQL query. Authenticated attackers with administrator-level access or higher can append additional SQL statements to existing queries. This allows extraction of sensitive information from the WordPress database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated administrators can inject arbitrary SQL through the fields parameter, exposing database contents such as user credentials, session tokens, and configuration secrets.

Affected Products

Media Sweep – WordPress Media Cleaner plugin versions 1.0.0 through 1.1.3
WordPress sites running the vulnerable plugin with administrator-accessible REST endpoints
Any hosting environment exposing the plugin's class-scan-files-controller.php REST routes

Discovery Timeline

2026-08-25 - CVE-2026-77824 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77824

Vulnerability Analysis

The vulnerability resides in the Media Sweep plugin's REST API layer, specifically within class-scan-files-controller.php and the shared class-query-builder.php utility. The controller accepts a fields parameter from authenticated REST API requests and forwards the value into the query builder. The query builder concatenates the parameter directly into SQL statements without invoking wpdb::prepare() or the WordPress escaping helpers such as esc_sql().

Because the injection point is a column list, standard prepared-statement placeholders cannot protect it and the code lacks an allowlist of permitted field names. An attacker submitting crafted fields values can terminate the intended select list, append a UNION SELECT, or embed subqueries that read from arbitrary tables including wp_users and wp_usermeta. Exploitation requires an authenticated session with administrator privileges, which limits the population of realistic attackers but does not eliminate risk from account takeover, insider misuse, or multi-tenant WordPress hosting.

Root Cause

The root cause is insufficient input neutralization on the fields REST parameter combined with dynamic SQL construction in the query builder. The vulnerable code paths are documented in the REST Controller, the Scan Files Controller, and the Query Builder. The query builder trusts caller-supplied identifiers and interpolates them into the final SQL string.

Attack Vector

An authenticated administrator submits a REST API request to a Media Sweep scan endpoint with a malicious fields value. The payload closes the legitimate column reference and appends an additional SQL clause, typically a UNION SELECT that returns password hashes, secret keys, or arbitrary table data in the JSON response. See the Wordfence Vulnerability Report for additional context. No verified public exploit code is available at the time of publication.

// No verified exploit code available.
// The vulnerability is triggered by supplying attacker-controlled SQL
// fragments in the `fields` REST parameter of Media Sweep scan endpoints.
// See the technical references for the exact vulnerable line numbers.

Detection Methods for CVE-2026-77824

Indicators of Compromise

REST API requests to /wp-json/media-sweep/v1/ endpoints containing SQL keywords such as UNION, SELECT, --, /*, or backticks in the fields parameter.
Unexpected outbound responses from the WordPress site returning columns not defined by the plugin schema.
Administrator sessions issuing scan requests at unusual times or from unexpected IP addresses.
Database error entries in debug.log referencing class-query-builder.php and malformed column identifiers.

Detection Strategies

Inspect web server access logs for POST or GET requests to Media Sweep REST routes with fields values that include SQL metacharacters.
Deploy Web Application Firewall (WAF) rules that block SQL syntax within the fields parameter of the plugin's REST namespace.
Enable WordPress query logging or the SAVEQUERIES constant during incident response to capture the executed SQL.

Monitoring Recommendations

Alert on administrator account activity that invokes Media Sweep endpoints outside of scheduled maintenance windows.
Monitor for anomalous read volumes against wp_users and wp_options tables using database audit logging.
Track WordPress plugin inventory to flag any site still running Media Sweep version 1.1.3 or earlier.

How to Mitigate CVE-2026-77824

Immediate Actions Required

Update the Media Sweep – WordPress Media Cleaner plugin to a version above 1.1.3 as soon as the vendor publishes a fixed release referenced in the WordPress plugin changeset.
Rotate WordPress administrator passwords and application passwords in case credentials were exposed through prior exploitation.
Review recent administrator activity and REST API access logs for evidence of fields parameter abuse.
Regenerate WordPress salts in wp-config.php and invalidate active sessions if compromise is suspected.

Patch Information

Upgrade to the fixed release published by the plugin maintainer. Review the Media Sweep Changeset and confirm that the query builder now validates fields against an allowlist and uses parameterized queries. Consult the Wordfence Vulnerability Report for the corresponding remediation guidance.

Workarounds

Deactivate and remove the Media Sweep plugin until an updated version is deployed.
Restrict access to the WordPress administrative interface using IP allowlists or VPN-only access.
Enforce multi-factor authentication for all administrator accounts to reduce the likelihood of privileged session abuse.
Add a WAF rule that rejects requests to /wp-json/media-sweep/* containing SQL syntax in query or body parameters.

bash

# Example: block Media Sweep REST access at the web server layer until patched
# nginx snippet
location ~* /wp-json/media-sweep/ {
    deny all;
    return 403;
}