Attacks Dictionary
SQL injection
Definition
SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.
Also called: SQLi
Last updated
Why it matters for WordPress
Plugins and custom code that build SQL with raw request data can expose posts, users, or the whole database. On WordPress, that usually means a vulnerable extension, not core itself. Public CVEs get automated fast.
How it shows up in practice
- Odd query strings that dump content or database error text
- Unexpected admin users or option changes with no human action in the log
- Scanner or advisory notes flagging a plugin CVE that mentions SQLi
What to do
- Keep WordPress, themes, and plugins updated.
- Remove unused plugins and themes.
- Prefer well-maintained extensions; check vulnerability databases when a CVE drops.
- For custom code, use
$wpdb->prepareand never concatenate untrusted input into SQL. - After a suspected SQLi incident, rotate secrets, audit users, and scan files.
Full walkthrough: SQL injection on WordPress.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
