CVE-2026-8705: ClearSale Total WordPress SQL Injection

CVE-2026-8705 Overview

CVE-2026-8705 is an unauthenticated SQL Injection vulnerability in the ClearSale Total plugin for WordPress affecting all versions up to and including 3.4.2. The flaw resides in the clearsale_total_push AJAX handler, registered under wp_ajax_nopriv_clearsale_total_push for unauthenticated callers. A commented-out die() in the wp_verify_nonce() failure branch allows execution to continue regardless of nonce validity. Attackers can inject SQL through the pagseguro[metodo] POST parameter, which flows unquoted into an UPDATE wp_cs_total_dadosextras query. Exploitation requires the target server to run PHP < 8.0, where loose type juggling lets strings such as "4 AND SLEEP(5)" satisfy the integer case 4: guard.

Critical Impact

Unauthenticated attackers can append arbitrary SQL to a backend UPDATE statement and extract sensitive data from the WordPress database on hosts running PHP earlier than 8.0.

Affected Products

• ClearSale Total plugin for WordPress, all versions up to and including 3.4.2
• WordPress sites with the clearsale_total_push AJAX handler registered for unauthenticated users
• Hosting environments running PHP < 8.0 where loose type juggling remains permissive

Discovery Timeline

• 2026-06-24 - CVE-2026-8705 published to NVD
• 2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-8705

Vulnerability Analysis

The vulnerability is a classic unauthenticated SQL Injection ([CWE-89]) reachable through WordPress's AJAX entry point admin-ajax.php. The handler clearsale_total_push is registered against wp_ajax_nopriv_clearsale_total_push, exposing the code path to any unauthenticated visitor. While the function calls wp_verify_nonce() to validate request authenticity, the die() statement that should terminate execution on failure is commented out. The function therefore continues processing attacker-controlled input even when the nonce check fails.

After the broken nonce check, the handler reads the pagseguro[metodo] value from the POST body and passes it through a switch ($metodo) { case 4: ... } branch. The matched branch builds an UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ... statement using direct string concatenation, with no quoting and no use of $wpdb->prepare(). Because the injected value is appended into the SET clause unquoted, attackers can extend the statement with additional SQL.

Root Cause

Three defects compound to produce the flaw: an nopriv AJAX registration that exposes a privileged write operation, a disabled nonce-failure terminator, and an unsanitized, unquoted query parameter. Reliance on PHP's loose comparison inside the switch further weakens the input guard.

Attack Vector

An unauthenticated attacker submits a POST request to wp-admin/admin-ajax.php with action=clearsale_total_push and a crafted pagseguro[metodo] value such as 4 AND SLEEP(5). On PHP < 8.0, the string is loosely compared to integer 4 and matches case 4:, reaching the vulnerable UPDATE query. Time-based and UNION-style payloads allow extraction of database contents including user credentials and session tokens.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report and the vulnerable handler source in trunk for technical references.

Detection Methods for CVE-2026-8705

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=clearsale_total_push from unauthenticated sources.
• Request bodies where pagseguro[metodo] contains SQL keywords such as SLEEP, UNION, SELECT, BENCHMARK, or comment markers (--, #, /*).
• Anomalous response latency on admin-ajax.php consistent with time-based blind SQL Injection.
• Unexpected rows or modifications in the wp_cs_total_dadosextras table.

Detection Strategies

• Inspect web server and WordPress access logs for clearsale_total_push invocations originating from non-authenticated sessions.
• Apply WAF rules that flag SQLi tokens in pagseguro[metodo] and related POST parameters.
• Correlate database query logs with web requests to identify malformed UPDATE wp_cs_total_dadosextras statements.

Monitoring Recommendations

• Enable MySQL general or slow query logging on WordPress hosts running the ClearSale Total plugin.
• Alert on sustained spikes in admin-ajax.php 200 responses with elevated response times.
• Track outbound DNS or HTTP from the database host that may indicate out-of-band SQLi exfiltration.

How to Mitigate CVE-2026-8705

Immediate Actions Required

• Deactivate the ClearSale Total plugin until a fixed release is installed.
• Upgrade the underlying PHP runtime to 8.0 or later to neutralize the loose-comparison bypass.
• Block requests to admin-ajax.php where action=clearsale_total_push is invoked without a valid authenticated session at the WAF or reverse proxy.
• Audit the wp_cs_total_dadosextras table and the wp_users table for unauthorized modifications.

Patch Information

As of publication, no fixed plugin version has been associated with this CVE in the NVD entry. All versions up to and including 3.4.2 are reported vulnerable. Monitor the ClearSale Total plugin repository and the Wordfence advisory for fix availability.

Workarounds

• Upgrade PHP to >= 8.0, which enforces strict type comparison in switch statements and breaks the "4 AND SLEEP(5)" == 4 bypass.
• Restrict access to wp-admin/admin-ajax.php for the clearsale_total_push action via WAF rules that require an authenticated cookie.
• Remove or rename the plugin directory if the functionality is not currently required.

# ModSecurity-style rule to block exploitation attempts
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026870501,msg:'Block CVE-2026-8705 ClearSale Total SQLi'"
  SecRule ARGS:action "@streq clearsale_total_push" "chain"
    SecRule ARGS:'pagseguro[metodo]' "@rx (?i)(sleep|benchmark|union|select|--|/\*|;)" "t:none"