Collected research

Persistent SQL Injection

Óâåäîìëåíèå î áåçîïàñíîñòè: New vulnerabilities in CapCC for WordPress

MustLive · securityvulns.ru

MustLive's advisory on the WordPress CapCC captcha plugin 1.0. CSRF on the plugin's option page drives an SQL injection whose payload persists in the captcha table and re-fires on every page view — self-inflicted DoS — which he presents as the first Persistent SQLi.

Record

Document

Óâåäîìëåíèå î áåçîïàñíîñòè: New vulnerabilities in CapCC for WordPress

Researcher

MustLive

Published by

securityvulns.ru

Topic

Injection

In the archive

• Collected in the 2008 research round

Tags

• sqli
• csrf
• wordpress
• php
• dos
• auth-bypass
• captcha-bypass
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of MustLive, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.