CVE-2018-3811

SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.

• CWE-89

• https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.htmlExploit, Third Party Advisory
• https://wordpress.org/plugins/smart-google-code-inserter/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8988Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43420/Exploit, Third Party Advisory, VDB Entry
• https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.htmlExploit, Third Party Advisory
• https://wordpress.org/plugins/smart-google-code-inserter/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8988Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43420/Exploit, Third Party Advisory, VDB Entry

Published

Jan 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3784A code injection in cryo 0.0.6 allows an attacker to arbitra…9.8
• CVE-2018-3785A command injection in git-dummy-commit v1.3.0 allows os lev…9.8
• CVE-2018-3786A command injection vulnerability in egg-scripts <v2.8.1 all…9.8
• CVE-2018-3787Path traversal in simplehttpserver <v0.2.1 allows listing an…7.5
• CVE-2018-3809Information exposure through directory listings in serve 6.5…
• CVE-2018-3810Authentication Bypass vulnerability in the Oturia Smart Goog…
• CVE-2018-3813getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0…
• CVE-2018-3814Craft CMS 2.6.3000 allows remote attackers to execute arbitr…
• CVE-2018-3815The "XML Interface to Messaging, Scheduling, and Signaling" …
• CVE-2018-3817When logging warnings regarding deprecated settings, Logstas…
• CVE-2018-3818Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site sc…
• CVE-2018-3819The fix in Kibana for ESA-2017-23 was incomplete. With X-Pac…