Attacks Dictionary
SQL injection
Definition
SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.
Also called: SQLi
Why it matters for WordPress
Plugins and custom code that build SQL with raw request data can expose posts, users, or the whole database. On WordPress, that usually means a vulnerable extension, not core itself. Public CVEs get automated fast.
How it shows up in practice
- Odd query strings that dump content or database error text
- Unexpected admin users or option changes with no human action in the log
- Scanner or advisory notes flagging a plugin CVE that mentions SQLi
What to do
- Keep WordPress, themes, and plugins updated.
- Remove unused plugins and themes.
- Prefer well-maintained extensions; check vulnerability databases when a CVE drops.
- For custom code, use
$wpdb->prepareand never concatenate untrusted input into SQL. - After a suspected SQLi incident, rotate secrets, audit users, and scan files.
Full walkthrough: SQL injection on WordPress.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
